4 ms·
Expired can happen clientside, just check the timestamp. Revoked would be a short blacklist that lasts the duration of the session, once a token is expired it n
by nathancahill 9y ago
Expired can happen clientside, just check the timestamp. Revoked would be a short blacklist that lasts the duration of the session, once a token is expired it no longer has to be revoked.
But I'm also curious how a revoked list would be handled with this service.
- hultner 9y agoThat's only true if you do not allow for long running sessions which are commonplace today. And it still requires a lookup every time to see if a particular session is blacklisted. From what I could grasp there's no mechanics for blacklists/revocations in the current implementation of this service.