Is it safe to use JWT primarily for auth, but fallback to session auth when needed?
I have written a single page application that uses Tymon's really handy JWTAuth package. I encountered a bit of a conundrum with using stateless auth via JWT with tokens that expire quickly. For instances in which users must upload large files to my site, the token was expiring before the upload was complete. Instead of just bumping up the ttl of the token, I decided it'd probably be safer to utilize Laravel's baked in session based auth as a fallback.
For now, most of my routes are authenticated via the JWT middleware; however, my upload routes are protected via the session based middleware. I just authenticate the session using Auth::attempt() at the same time that I generate a JWT. The user receives two valid forms of authentication.
My question is whether or not this seems unsafe. To me, I can't see why this is a security issue, as both are same forms of auth. One is stateless, and one is not. Thanks for the input.
Please or to participate in this conversation.