3 ms·
Have a relatively short expiration time. Or, if you want to have more immediate revokes without having a ridiculously short expiration time, keep a list of bla
by epicide 8y ago
Have a relatively short expiration time.
Or, if you want to have more immediate revokes without having a ridiculously short expiration time, keep a list of blacklisted tokens that you clear at least every <refresh time> seconds.
At the end of the day, JWTs still have to be accepted by the server, which you have complete control over.
- lossolo 8y agoI can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or keep them in database which defeats the purpose of using JWT for sessions already, as I could do what I do now, just keep normal tokens in Redis and check them on every request.
- Polyisoprene 8y agoAssuming blacklisting happens infrequently, you would have a few orders of magnitude fewer entries and could keep them in-memory on each server and have them fetch them all once every X seconds instead of for each request.
- lossolo 8y agoA lot of assumptions there to justify using JWT tokens. Unfortunately I can't allow someone that is blacklisted to use the service for X seconds.