3 ms·
I recently started using JWT and had the same problem, I ended up keep the expiration very low and having the client constantly refresh when they need it, and j
by dec0dedab0de 8y ago
I recently started using JWT and had the same problem, I ended up keep the expiration very low and having the client constantly refresh when they need it, and just forget it when they don't
- andrewstuart2 8y agoThis is a very popular conclusion when considering AuthN and invalidation. Keep the state at the provider and just prevent issuance of new tokens (whether signed certs, JWTs, etc) if/when the user requests access be revoked. What you're really doing is externalizing your state to one already universally shared, and which we already have a lot of tools to manage: the current time.
- abraae 8y agoIt's a reasonable conclusion too, when revoking tokens because of a hack/leakage. In these situations human reaction times are involved, which will be at least minutes and maybe hours or days. Having tokens with an expiry of e.g 10 minutes, but with no ability to revoke, is a totally reasonable trade-off in these circumstances.