3 ms·
> While I agree that the tokens must be expired on logout Is there really that much additional security over deleting tokens locally when logging out, but expi
by Alex3917 11y ago
> While I agree that the tokens must be expired on logout
Is there really that much additional security over deleting tokens locally when logging out, but expiring all existing tokens (using a timestamp) on password change?
Blacklisting individual tokens requires storing them in the db and then looking them up each time a user logs in. It seems like given the app already uses TLS, the tiny security gain isn't big enough to justify the performance impact.
- deleted 11y ago[deleted]
- dwightgunning 11y agoI agree although I think about it more in terms of development and maintenance effort. There's plenty of other relatively computationally and IO intensive activity happening during login so I can't see an extra select having a tangible impact to performance.
- Alex3917 11y agoThe issue isn't tokens getting created on login, it's them getting validated on every request. That's already 40-50ms, even without the db hit each time.