ParentFull threadhasley·Can't a system be DDoS'ed with wrongly signed JWTs as well?Is signature checking (much) cheaper than finding an opaque session ID in a database?View on HN