All geek questions in one place

Should I decode client side JWT?

I am creating an Android application and plan to use Json Web Tokens (JWT) for authentication.

As soon as my server returns a response with the generated token, does it make sense to decode the token on the client side to read user information (aka payload), or should I use the token strictly as an authentication mechanism and make the second request user information?

thanks

+4
source share
1 answer

Like most things, it depends. If you control the authorization server (i.e. your API that you are calling), I really do not see any problems reading the contents of the token on the client side.

If you call a third-party API and authenticate on a server that you do not control, I would not depend on the contents of the JWT token. A third party may decide to change the requirements in the token or even start encrypting the token.

+2
source

Source: https://habr.com/ru/post/1614805/

More articles:


All Articles