5 ms·
Anyone do the kerberos way, with two lifetimes? In theory this allows one time authentication, paired with continuous renewal - where refusing renewal becomes a
by e12e 8y ago
Anyone do the kerberos way, with two lifetimes? In theory this allows one time authentication, paired with continuous renewal - where refusing renewal becomes a way to invalidate the session/ticket (by way of expiration):
https://stackoverflow.com/questions/14682153/lifetime-of-kerberos-tickets https://stackoverflow.com/questions/14682153/lifetime-of-ker...
Ed: Note that the service doing the renewal won't need the user/password - only a way to check if the user is blacklisted, as well as a way to sign/make tokens - and doesn't have to be the same system that issues the initial token.
- amaccuish 8y agoMost systems use this method but over two tokens, usually referred to as a session/access token and a refresh token. See OAUTH.
- brokenwren 8y agoExactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.
- e12e 8y agoI'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration". Obviously the renewal service would need to be able to sign the new/extended token.