3 ms·
> So some of those things are true, but you can definitely and almost certainly should expire tokens (and reissue before expiry new tokens) after a short time w
by joepie91_ 7y ago
> So some of those things are true, but you can definitely and almost certainly should expire tokens (and reissue before expiry new tokens) after a short time window, which alleviates some of the security concerns mentioned.
That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem.
> Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on.
You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format.
- andy_ppp 7y ago> That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem. No you don't, as stated you can refresh your token before it expires. > You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format. I think you can validate the authenticity of your JWT without having to go to a database. This is much more secure than local storage or even a plain old cookie. JWT provides a useful set of features and just because in your opinion it isn't useful plenty of people disagree with your points.