5 ms·

I guess that depends on the application. So long as you can guarantee that it happens within a given time frame that might very well be good enough. That said,

• zerkten 8y ago
  > I guess that depends on the application. So long as you can guarantee that it happens within a given time frame that might very well be good enough. I think the right answer is that you need to develop some type of threat models, review them periodically, and then decide what's right. Just because you can't think of a problem with the approach now doesn't mean it won't happen later, or be a component of a larger attack. The "given time frame" above may be more than enough for certain attacks you can identify in initial threat modeling. From the long-term operational perspective, it may also be preferable for the application owner to have immediate invalidation. This might be inconvenient to the development team just trying to get their work done now, but is it a good idea to ignore this requirement? For various reasons, dev teams tend to push on only for there to be problems later.