Tag Info

New answers tagged


Yes if id is id of the device cause you need to store device id in some place. If you can install programs on the server better to store login tokens not in database but in some external key value storage like redis or memcached, if you can do it of course.


Some browsers can also be identified via HSTS Supercookies. This is where you can embed a page with requests to random sets of secure and non secure resources for each visitor, then monitor the pattern of their requests on a returning visit. If each resource is requested in the same pattern, then you can use that information to identify the user. These are ...


As it turns out, it's sort of a combination of the Authorization flow and the Implicit flow. The Implicit flow is for client-based applications, and the authorization flow allows for server-to-server access, I think. What ended up being the right answer is retrieving an access_code from Google, with a specific audience specified. The audience is the ...


The purpose of a JSON Web Token is to authenticate you, not to secure the payload. Securing the payload is a separate operation. Naturally, you can encrypt the payload if you wish, but that's not the purpose of a JSON Web Token. You don't encrypt the payload for the same reasons that you don't encrypt anything else: the cost (however small it is) exceeds ...

Top 50 recent answers are included