4 ms·
Why do you think you can't invalidate a JWT? Store a JWT that is associated with some object in a database that has the field `isInvalidated`. This isn't rocket
by btdiehr 10y ago
Why do you think you can't invalidate a JWT? Store a JWT that is associated with some object in a database that has the field `isInvalidated`. This isn't rocket science. Sure - this turns the JWT token into a session but there is no way to invalidate based on something that isn't determined at creation time without storing something in a database.
- jontro 10y agoWhat's the point of using a JWT if so? This effectively converts it into a session token
- baseonmars 10y agoYou can create a JWT without writing to a datastore - this is a key difference.
- kensign 10y agouse a ttl on like a cache store, such as redis
- jcoffland 10y agoYes, but this is still a deadend.
- zbjornson 10y agoHow so? It's effectively a micro-optimization that will have no real effect, but you can do a simple "exists" query when searching the revocation list, and the TTL keeps the collection small. Not advocating for JWT as it's a silly mess to do everything correctly, but it is possible.
- jcoffland 10y agoSearching a revocation list misses the point of RESTful authentication.