Session_ID in JWT

- User signs in, server recieves
  - User
  - pass
  - device mac addr or something
- encrypt `${session_id}-${user_mac_address}` and return to client as cookie

- every req to server would contain the user's mac addr or whatever device-specific data and checks whether it matches the encrypted value

- User signs in, server recieves
  - User
  - pass
  - device mac addr or something
- encrypt `${session_id}-${user_mac_address}` and return to client as cookie

- every req to server would contain the user's mac addr or whatever device-specific data and checks whether it matches the encrypted value

import { BoringCrypto, SymmetricKey } from "ciphersweet-js";

let brng = new BoringCrypto();
let key = new SymmetricKey(env.ENCRYPTION_KEY);

...

    const hashedAccessToken = await brng.encrypt(access_token, key);
    const hashedRefreshToken = await brng.encrypt(refresh_token, key);

import { BoringCrypto, SymmetricKey } from "ciphersweet-js";

let brng = new BoringCrypto();
let key = new SymmetricKey(env.ENCRYPTION_KEY);

...

    const hashedAccessToken = await brng.encrypt(access_token, key);
    const hashedRefreshToken = await brng.encrypt(refresh_token, key);