Sabitlenmiş Tweet
David
10.2K posts

David retweetledi
David retweetledi
David retweetledi
David retweetledi

Most devs use JWTs.
Few understand what’s going on.
That’s why auth breaks, tokens leak, and apps get exposed.
Let’s fix that.
JWT means JSON Web Token.
It’s a way to verify a user without storing session data on your server.
Simple flow.
User logs in → server verifies → server signs a token → client stores it → client sends it on every request.
No database lookup for every request. Fast.
A JWT has 3 parts.
Header. Payload. Signature.
Header tells you the algorithm used.
Payload carries data like userId, role, expiry.
Signature proves the token was issued by your server.
Important point.
The payload is not encrypted. It is encoded.
Anyone can decode it.
Never store passwords or sensitive data inside.
Example payload:
{userId: "123",role: "admin"}
Now the real issues most devs face.
Storing tokens wrong
If you put JWT in localStorage, XSS can steal it.
Safer option is httpOnly cookies.
No expiry
If your token doesn’t expire, it’s a security risk.
Always set exp.
No refresh token system
Short-lived access token. Longer refresh token.
When access expires, refresh generates a new one.
This keeps users logged in without risk.
Weak secret keys
If your secret is simple, your token is easy to forge.
Use strong env secrets.
No validation
Always verify token on protected routes.
Check signature. Check expiry. Check user role.
Quick Node.js example:
jwt.sign({ userId }, SECRET, { expiresIn: "15m" })
jwt.verify(token, SECRET)
Another key decision.
JWT vs sessions.
JWTStatelessBetter for APIs and scaling
SessionsStored on serverEasier to revoke instantly
Pick based on your system, not hype.
In real apps, combine both ideas.
Use JWT for access. Store refresh tokens in DB.Blacklist when needed.
If you’ve ever had auth bugs, it’s usually one of these mistakes.
Fix this early and your backend becomes solid.
What part of JWT confuses you most. Expiry, refresh flow, or storage?
English
David retweetledi

“When the going gets tough, You don’t want a criminal lawyer. You want a “Criminal” lawyer”
S∆IN✞ @The_Big_Chifa_
Who are you calling to defend your life in court?
English
David retweetledi
David retweetledi

What if all this is a distraction to throw us off and she is actually playing Miles Morales…?
Austin Medeiros@Austin_Medzz
Jean Grey from an official Marvel Comics artist… Looks identical to Sadie Sink in #SpiderManBrandNewDay 👀
English
David retweetledi

yamal playing like 50games more🤣🤣🤣
The Touchline | 𝐓@TouchlineX
🚨 Top U-18 goal scorers in Europe this season.
English

@Poeticmedic1 Apple TV is not available in Nigeria
Disney+ is not available in Nigeria
Hulu is not available in Nigeria
Yet we should not pirate
Oya now 😂
English













