3 ms·
You should have tokens with short durations that are refreshed upon use. That greatly reduces the odds of a token being stolen or leaked and then used before it
by jrs95 8y ago
You should have tokens with short durations that are refreshed upon use. That greatly reduces the odds of a token being stolen or leaked and then used before it expires.
- CiPHPerCoder 8y agoYou're getting closer to the problem: JWTs were designed to be single-use (or very, very short lived) claims (with optional cryptography features). It was never meant to be "offload everything to the client and obviate the need for server-side storage". It was never meant to be the new hotness among the NoSQL Scalability crowd.