SessionIds and JWTs

ServiceStack Authentication
1

Is it true that a new sessionid is created on every call when using a JWT, or have I programmed my JWT reader incorrectly

The reason I’m asking is because we found a bug when calling a service that has VaryByUser=true, the cache never hits because the sessionid is changing every call.

2

When the SessionFeature plugin is enabled any missing session Ids are created, but they wouldn’t be used if Authenticated via JWT.

You can disable them from being created with:

SetConfig(new HostConfig {
    AllowSessionCookies = false
});