JWT best practices for max security

[@PSAfterHours]

How to revoke a JWT token: kzbin.info/www/bejne/oKulZYecorSNr9k

[@jorgeromero4680]

can you use jwt in inav?

[@ShibraTai]

What if the token gets leaked....if a person has the token he/she would be able to hit the api

[@imissthestacy4803]

It would indeed be stolen and used to access api but then expired, as a dev you'd better to protect from this theft rather then figuring out how to stop a stolen one, use http only cookies secure https connection

[@heshiebee]

Great video, very informative

[@matthewrichardson8162]

Great video!

[@syffs-sq6bw]

sorry but either you dont know what you're talking about, or you're omitting the truth? JWT used in an authorization context is a secret, even if it doesn't contain any secret info, as they're used to perform authenticated calls! There's much more to JWT security than what you mention, starting with where they're stored for instance, or how they're generated (fingerprint?) or combined with other security measures.