3 ms·
But then it isn't stateless, right? Because you need to know which current tokens are unrefreshable. You only have to involve state in 1 request every 10-15 mi
by bgentry 7y ago
But then it isn't stateless, right? Because you need to know which current tokens are unrefreshable.
You only have to involve state in 1 request every 10-15 minutes upon refresh. All other requests can be done without having to check for revocation. This is a pretty nice real-world tradeoff.
- abathur 7y agoWhile I haven't taken the leap to using a JWT in any of these cases yet and am a little bearish on them, I do also feel like the baby goes out with the bath-water, here. Nothing about adopting JWT says you can't still use a full auth check for state-changing endpoints, and use a stateless session to shave some evaluation time off of frequent read-only requests for data that isn't terribly sensitive. You probably shouldn't do it lightly or prematurely since it makes it harder to reason about authentication, but I think it's worth considering whenever you're optimizing.