4 ms·
I can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or
by lossolo 8y ago
I can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or keep them in database which defeats the purpose of using JWT for sessions already, as I could do what I do now, just keep normal tokens in Redis and check them on every request.
- Polyisoprene 8y agoAssuming blacklisting happens infrequently, you would have a few orders of magnitude fewer entries and could keep them in-memory on each server and have them fetch them all once every X seconds instead of for each request.
- lossolo 8y agoA lot of assumptions there to justify using JWT tokens. Unfortunately I can't allow someone that is blacklisted to use the service for X seconds.