3 ms·
How does it handle revoked and expired sessions? From my prior research this seems to be a problem with the JWT which would either require distribution of ever
by hultner 9y ago
How does it handle revoked and expired sessions?
From my prior research this seems to be a problem with the JWT which would either require distribution of ever growing blacklists or session verification through shared server side sessions.
Would also love to see some API documentation.
I really like the idea and always reimplementing login services seems like unnecessary hassle.
- nathancahill 9y agoExpired can happen clientside, just check the timestamp. Revoked would be a short blacklist that lasts the duration of the session, once a token is expired it no longer has to be revoked. But I'm also curious how a revoked list would be handled with this service.
- hultner 9y agoThat's only true if you do not allow for long running sessions which are commonplace today. And it still requires a lookup every time to see if a particular session is blacklisted. From what I could grasp there's no mechanics for blacklists/revocations in the current implementation of this service.