Programming Books

Cute dependency injection (DI) framework for Python with agreeable API and everything you need https://github.com/reagento/dishka

Two ways to keep a user logged in. And they fail in very different ways. After login, you need to remember who the user is. There's typically two common approaches: • Session token: a random ID. The server stores the session and looks it up each request. • JWT: a signed token holding the user's info. The server just verifies the signature, no lookup. JWTs scale well because there's no server-side storage. That's also their weakness. This is because you can't easily revoke a JWT before it expires. A logged-out user's token still works until it times out. Sessions you can kill instantly. The solution, which is still not ideal, for JWTs is short expiration and token blacklisting. Stateless is convenient, but "can't revoke" is a real security tradeoff. Source