4 ms·

The article exaggerates these issues. Also there are easy solutions available for those concerns. It's trivial to store a token version on your user object and

The article exaggerates these issues. Also there are easy solutions available for those concerns. It's trivial to store a token version on your user object and invalidate any token that has the wrong version.

dchest 8y ago
Then just store session ID there and get rid of JWT.
- indeyets 8y ago
  There's big difference between fetching session from db and validating id via short local (push distributed) revoke list. Well, that's if project is large enough to saturate storage :)