hashamali

I think this is generally a side effect of people considering actions to be a replacement for the Controller part of MVC. Meaning any sort of logic (including legitimate state manipulation) is jammed into actions.

Personally, I don't see that as a huge problem. Better in an action than sprinkled into components. As someone else mentioned, redux-thunk makes this even easier (and one could argue, promotes this).

React Native is a good place to start. Not only would you be able to put together mobile apps, but the knowledge would be applicable to building web pages as well.

JWT bearer tokens have worked well in my experience, though I haven't used PASETO. The main benefit is being able to use the same authentication mechanism for mobile and web apps.

The biggest drawback is the inability to revoke tokens without giving up statelessness. Keeping a KV blacklist isn't the end of the world, especially if expiration times for tokens are short. But at that point, the cost/benefit vs cookies+sessions gets blurry.

Some general JWT tips:

* Use a sufficiently long secret key if you're using HMAC based signing (https://auth0.com/blog/brute-forcing-hs256-is-possible-the-i...).

* Use bearer tokens to avoid CSRF attack surfaces.

* Avoid long (or non-existant) expiration times.