Hacker News new | ask | show | jobs
by cercatrova 1360 days ago
But why not use a session cookie also with HttpOnly?
1 comments

I deal with applications that run multiple instances. To support that, it would require either an affinity cookie to "stick" the session to a single instance (which could go down at any time based on load) or a centralized session database. I don't like either of those options, so I use JWT cookies.