4 ms·
Why would you need to make a request to another server for this purpose? Hint: you don’t — but I figure taking the Socratic approach may be more convincing.
by cstrahan 7y ago
Why would you need to make a request to another server for this purpose?
Hint: you don’t — but I figure taking the Socratic approach may be more convincing.
- rblatz 7y agoYou could pre share a public key, but a common way is to use the discovery mechanism in OIDC to automatically manage key distribution/rolling.
- blackflame 7y agoBecause else how do you handle key revocation?
- aaomidi 7y agoWhich is the point of the post. If you need to do revocation you need to call an external server. If you need to call an external server why do JWT?
- blackflame 7y agoBecause pinging another server for a few bytes of data and offloading that working memory to the client side is much more efficient than storing the session data in server memory in between requests. Furthermore a single coordinating key server can work in conjunction with many micro-services to simplify architecture, security, and hardware requirements.