3 ms·
> When someone's account is compromised, is another situation. Why is that scenario relevant if tokens are supposed to be used once per request and short-lived
by geezerjay 8y ago
> When someone's account is compromised, is another situation.
Why is that scenario relevant if tokens are supposed to be used once per request and short-lived?
Once a token is used, it's supposed to be expired and no longer in use. Both the expiry timestamp and the nonce fields already handle those use cases.
- iamwil 8y agoSuppose to be once per request and short-lived. But that's not specified in the thread above. Previous person mentioned logout, so I assumed we were talking about session tokens--which I understand its a misuse of JWTs--and is why he/she's mentioning it. But if we're talking about just one time auth tokens, then yeah, you don't need expiry ahead of the expiry time, and it's plain it's a non-issue.