Comment on API Security Checklist for developersComments−EGreg9yThere is a lot more you can do.For example you can sign session IDs or API tokens when you issue them. That way you can check them and refuse requests that present invalid tokens without doing any I/O.−PetahNZ9yJWT does that.
Comments
There is a lot more you can do.
For example you can sign session IDs or API tokens when you issue them. That way you can check them and refuse requests that present invalid tokens without doing any I/O.
JWT does that.