2 ms·
Invalidating the site secret is my go-to strategy right now, but I have wondered how to sign out a single user across all their logged-in devices. Anyway, this
by mwpmaybe 10y ago
Invalidating the site secret is my go-to strategy right now, but I have wondered how to sign out a single user across all their logged-in devices. Anyway, this idea is interesting and would be pretty straightforward to implement. Thanks!
- ponyous 10y agoMaybe you could salt the secret per user and store it in the DB. This would allow users to have a feature like "Logout from all devices". I am not sure how you would query the database to get the salt? JWT as key and salt as value? Or maybe sending userId with each request? Anyone know any good articles I can read on the topic?
- numbsafari 10y agoThe point is to avoid all the database updates. So, I would recommend not going that route. If you need to sign out a user across all logged-in sessions, use a revocation list based on UID, rather than token-id.
- merb 10y agoyep probably the better idea. eventually we combine sessions and JWT Tokens. The session id is kind of a refresh token that refreshes the token if it was expired and the user didn't generate a new token in less than one minute. than it will use the session id will query the database and create a new token if the session is still valid.