[dzonga]

JWTs strike again.

encrypted cookies still work & they're stateless. & yeah you can pass cookies between servers & also server - S.P.A.

to BoBDaHacker - great research but slow down on the a.i writing.

[aembleton]

If the backend doesn't check the credentials then it doesn't matter if its JWT or encrypted cookies or anything else.