3 ms·
However every service now needs access to the list of hashed passwords.
by Normal_gaussian 10y ago
However every service now needs access to the list of hashed passwords.
- bjt 10y agoOr access to a service that has access to the hashes/revocation strings. Which puts you in a similar situation to non-JWT scenarios where every service has to phone home to check a token's validity. I'm not saying all tokens should be made revocable in this way. I'm saying that people claiming "you can't invalidate a JWT" are overstating their case. If you really need to do invalidation, this is one option.