wouldn't it better to be JWE in order to prevent from leaking?

not really. The JWT is stored in httpOnly cookie. So the JS on the frontend can't read it anyway. If somehow it's stolen, then the attacker can use it to access APIs (and get / modify any user info), regardless of if it's a JWE or JWS

So there are two things to keep in mind: - Do not store any sensitive info in the JWT, like the user's phone number etc.. If that must be tied to a session, store it in session data (in the db) - Keep JWTs short lived.

hmm, I see.

yea i mean it's a debate. It's not 100% that i am correct and that JWE is not more secure than JWS.

It's ok, I got your point!

I think it sounds reasonable. If the leaking happen, I should worry more about the API server is wide opened for a while, rather than a small piece of user info

mmhmm

hi @User

Hello @sathya

Hey!

👋

What brings u to our server?

saw this tool on the y combinator site and had some questions. will follow up in the questions channel

👍

hey!

👋

hey @User

i need help

i dont get how to do this

the SaaS option isn't working, so i opted for the self-hosted option

i started the docker container, now what do i do?

Please try the SaaS option again

There was a permission issue on our end which made it stop for a few mins.. have fixed that

thanks! It works now

You can follow this video: which guides you through implementing us.

thanks, will do

👋 I hope everyone is keeping safe 🙂

ICYMI: https://identityunlocked.auth0.com/public/49/Identity,-Unlocked.--bed7fada/c71b9fbd (Transcript available as well)

@User thanks!