3 ms·
What does the revocation list look like? "Reject all tokens for user X issued before timestamp Y?" Or do you assign UUIDs to your tokens?
by mwpmaybe 10y ago
What does the revocation list look like? "Reject all tokens for user X issued before timestamp Y?" Or do you assign UUIDs to your tokens?
- numbsafari 10y agoI assign a unique ID for each token (the `jti` claim). So each token has a unique identifier and can be invalidated that way, and every token has the user's ID (the `sub` claim), and can be invalidated that way, if that fits your use case.
- deleted 10y ago[deleted]
- mwpmaybe 10y agoI read this wrong the first time. That makes sense. Thank you.