

New answers tagged


Could I query your "Solution for 1st problem": Solution for 1st problem: Both Desktop App and API share a Secret Key that the API will use to generate the JWT and the Desktop App will use to verify this JWT. The way you're implemented this now - if somebody recovers your secret from the desktop app, they could use this to create a new JWT token that both ...


Problem 0: You don't need to send the hash of the password, because you're already using TLS (HTTPS). If you do send the hash, then the hash becomes the password. Problem 1: Preventing users from generating a fake JWT response. You're already using TLS. Pin your server's certificate. That is, include the server's public key in your app. If anything ...

Top 50 recent answers are included