5 ms·
It sounds like you mean if you change the signature used to sign the tokens, then existing tokens will fail validation without hitting the db? If so, that's not
by zbjornson 10y ago
It sounds like you mean if you change the signature used to sign the tokens, then existing tokens will fail validation without hitting the db? If so, that's not too practical because all of your users are suddenly signed out. What myself and the two other posters I think encountered is that you have to store revoked/invalidated tokens in a blacklist, and then check that a token in a request is not in that blacklist. (That was my first point, at least.)
- TomMarius 10y agoNo, I simply meant that instead of checking if a token is valid, you can first check if a token is obviously invalid (e.g. expired, wrong claims, wrong audience...), and immediately return if so, thus reducing the load on your application servers and databases; and only then query the database to check if the token has been revoked.