3 ms·
As the article mentioned, revocation is a problem with the stateless approach. I've never seen a way to revoke individual tokens statelessly -- you either need
by twblalock 7y ago
As the article mentioned, revocation is a problem with the stateless approach. I've never seen a way to revoke individual tokens statelessly -- you either need to maintain state about the valid tokens, or maintain state about a revocation list.
- greiskul 7y agoI don't think it's possible to do revocation in a stateless manner. The token that you are revoking was once valid, and when you decide to invalidate it, this change of state needs to be persisted somewhere. But yeah, if revocation is rare and only few tokens are invalid at any given time (which can be easy by adding an expiry field to tokens), keeping a revocation list is the way to go.