3 ms·
> So every user on your system has to reauthenticate if one client token is compromised? No, because you would also store either a separate datetime or uuid on
by Alex3917 10y ago
> So every user on your system has to reauthenticate if one client token is compromised?
No, because you would also store either a separate datetime or uuid on each user model. And if just one user has their credentials compromised, then you would bump the date or generate a new UUID for just that user.
The global datetime would only be bumped if some site wide vulnerability were found.
- theptip 10y agoGot it, didn't catch that you were referring to storing that timestamp per-user. That's what I do in my system.
- igl 10y agoSo there is a db roundtrip involved? Like a inverted session. Whats the point of using jwt then?
- Alex3917 10y agoFor most web frameworks, the user model gets retrieved from the db automatically whenever an authenticated request is made. So there is no extra lookup.
- igl 10y agoOh man. Proponents say critics dont offer alternatives at the same time they always literally 'reverse' engineered sessions if you dig deep enough. I give up. JWT is just a hip thing to do right now. :(