4 ms·
> One less DB query. This trait constantly appears in threads about JWT. But then how do you handle token invalidation? I wonder how big IT companies (Google,
by hdhzy 10y ago
> One less DB query.
This trait constantly appears in threads about JWT. But then how do you handle token invalidation?
I wonder how big IT companies (Google, Microsoft, Amazon) are really doing it...
- jsjohnst 10y agoMost of the big companies to my knowledge generally don't depend on client side storage of session state (they might in a few isolated cases, but in general avoid it).
- hdhzy 10y agoThanks. Google uses interesting approach to handling service accounts: JWT is used as user credential once to get the access token (session credentials) that is reused between requests. https://developers.google.com/identity/protocols/OAuth2ServiceAccount https://developers.google.com/identity/protocols/OAuth2Servi...