4 ms·
> This means that you cannot, for example, invalidate the session of an attacker after detecting a compromise. You also cannot invalidate old sessions when a us
by Alex3917 8y ago
> This means that you cannot, for example, invalidate the session of an attacker after detecting a compromise. You also cannot invalidate old sessions when a user changes their password.
Sure you can. Just have a 'date_password_last_changed' field on your user model, and compare that with the issued_at date on the jwt. Since your user model presumably gets retrieved for each authenticated request anyway, there are zero extra database lookups. Similarly, if there is a global compromise then just rotate the secret key use used to signed the JWT.
- m4n 8y agoUpdating the 'date_password_last_changed' will invalidate all the tokens for a user. It solves the purpose but has its own trade offs.
- Alex3917 8y ago> Updating the 'date_password_last_changed' will invalidate all the tokens for a user. If someone is changing their password because it has potentially been compromised, what is a scenario where you would not want to invalidate all of their existing tokens?