4 ms·
"You cannot invalidate individual JWT tokens" This is not exactly true. There are lots of things you can do to expire tokens. For instance, every JWT has a cre
by tebruno99 8y ago
"You cannot invalidate individual JWT tokens"
This is not exactly true. There are lots of things you can do to expire tokens. For instance, every JWT has a creation date stamp so you could say on the server side all tokens created before Time.Now() no longer accept as valid. Allowing users to expire ALL tokens, etc.
- nneonneo 8y agoSo you need to maintain state whenever tokens get invalidated, and check this state on every token-bearing request. At that point why not just fetch the rest of your session data out of your database? And if it’s some kind of global cutoff - well, now every revoked session comes with a log off for every user, which is a usability nightmare.
- zimpenfish 8y ago> you could say on the server side all tokens created before Time.Now() no longer accept as valid But that's not anywhere near "invalidate individual JWT tokens" - you're invalidating -every- token before `Time.Now()`. Unless you store a different "valid after" time per user and then you're back to storing sessions in the DB, aren't you?