4 votes
Accepted

Should an access token really be cryptographically signed?

Signed cookies/tokens are particularly useful when either the token is issued by one party but must be verified by a third party; or the contents of the token are guessable, so that tampered/forged ...
user avatar
  • 123k

Only top scored, non community-wiki answers of a minimum length are eligible