3 ms·
The point is to avoid all the database updates. So, I would recommend not going that route. If you need to sign out a user across all logged-in sessions, use a
by numbsafari 10y ago
The point is to avoid all the database updates. So, I would recommend not going that route.
If you need to sign out a user across all logged-in sessions, use a revocation list based on UID, rather than token-id.
- merb 10y agoyep probably the better idea. eventually we combine sessions and JWT Tokens. The session id is kind of a refresh token that refreshes the token if it was expired and the user didn't generate a new token in less than one minute. than it will use the session id will query the database and create a new token if the session is still valid.