3 ms·
You blacklist your tokens in a cache and that's all.
by pinguinFromY 9y ago
You blacklist your tokens in a cache and that's all.
- e12e 9y agoSo, for a secure system, the blacklist cache/service becomes a single point of failure (see also certificate revocation lists, ssl/tls). I personally think renewable, short-lived tickets/tokens are a better evil - accept that a compromised session is valid for 10 minutes (5+worst-case/accepted clock drift). A long-lived certificate can encode authorization + but needs a short-lived ticket to be valid ("an I'd card that says three star general and today's pass phrase").