Why is it being used in Eshopbox?

• User Authentication

Audience :

Users, backend and Frontend Developers.

Reading Material :

Dos and Don’ts

Dos

• The signing key should be treated like any other credentials and revealed only to services that need it.

• Give tokens an expiration.

• Add generated access Token in Cache.

Don’ts

• Do not add sensitive data to the payload.

• Do not send tokens over non-HTTPS connections as those requests can be intercepted and tokens compromised.

• Do not call generate access Token Api on each each Request.