3 docs tagged with "Authentication"

Keep using $_SESSION, but store the session in a signed JWT cookie instead of on the server: no Redis, no sticky sessions.

Create and validate JWT tokens in a few lines, with the same API for a shared secret or a key pair, and no weak keys accepted.

Users, passwords, tokens and per-user properties behind one service, on any database, without adopting a framework.