4 ms·
The main and only argument against JWT tokens for me in context of user sessions is that I cannot revoke them if I block user account.
by lossolo 8y ago
The main and only argument against JWT tokens for me in context of user sessions is that I cannot revoke them if I block user account.
- Declanomous 8y agoWell you can block them, it just means you lose advantages of a JWT, like not requiring a database hit.
- lossolo 8y agoThis is the main issue, there is no point in using JWT tokens for me in context of sessions. I can just use standard solution and keep normal tokens in Redis if I need to make db call anyway.
- epicide 8y agoHave a relatively short expiration time. Or, if you want to have more immediate revokes without having a ridiculously short expiration time, keep a list of blacklisted tokens that you clear at least every <refresh time> seconds. At the end of the day, JWTs still have to be accepted by the server, which you have complete control over.
- lossolo 8y agoI can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or keep them in database which defeats the purpose of using JWT for sessions already, as I could do what I do now, just keep normal tokens in Redis and check them on every request.
- Polyisoprene 8y agoAssuming blacklisting happens infrequently, you would have a few orders of magnitude fewer entries and could keep them in-memory on each server and have them fetch them all once every X seconds instead of for each request.
- lossolo 8y agoA lot of assumptions there to justify using JWT tokens. Unfortunately I can't allow someone that is blacklisted to use the service for X seconds.