3 ms·
what about setting a secure cookie with a jwt, and expiring it when you log-out? what is the utility in server-sessions? (aside from the ability to revoke it
by justaaron 8y ago
what about setting a secure cookie with a jwt, and expiring it when you log-out?
what is the utility in server-sessions?
(aside from the ability to revoke it at any time from the server.)
- anon1252 8y ago> and expiring it when you log-out? and how would you do that if the user doesn't actively log out of a service?
- justaaron 8y agoset the cookie in the response to their next request to you? specifics depend upon the language and framework used on the server, etc...
- detaro 8y agoDo you mean "delete the cookie" with "expiring it"? Then that doesn't help against an attacker which already has obtained the JWT, they can still use the JWT until it's expiry.
- justaaron 8y agowhat i propose: 1) login = sending username and hashed password (over tls) that does a bcrypt etc, compares to bcrypted etc hash in db, if correct = provide a jwt set as a cookie with "secure httpOnly", jwt should be logged. 2) logout = request to server, server sets cookie with "token=empty;expires:1970yaddayadda" as it's httpOnly there's no client-side messing baout with the cookie otherwise 3)_all pages send cookie with each request, so must be tls upon logout, cookie has empty token, must be re-set with new token. old token, if stolen, can be compared with logged history, etc. what do you see, in terms of flaws?
- justaaron 8y agoso, what about a single-use token you exchange for another token (or not)?