4 ms·

How does keeping a short token in redis or other would make the application easier to DOS than any other resource?

• ravenstine 7y ago
  Because keeping a blacklist means keeping a list of all invalid tokens that haven't expired. If a user creates a crapload of sessions, you have to keep a running list of all the invalid tokens until they expire, which creates a few problems. You now have to have some mechanism to clear out tokens that have expired, which totally defeats one of the benefits of JWTs. And keeping a blacklist opens up the doors to someone slamming your /session endpoint, eventually running out your storage and/or memory because the blacklist will just keep growing. Sure, you can build in rate limiting, which you should have anyway. The reason I think this is still a problem is that a lot of amateurs are going to go straight for JWT and are too inexperienced or lazy to implement rate limiting. But why add all this complexity? Just have a whitelist, and you avoid these problems.
  • Znafon 7y ago
    > You now have to have some mechanism to clear out tokens that have expired, which totally defeats one of the benefits of JWTs. I think we are making the same argument, JWTs are supposed to be stateless but can't as you need to be able to logout. > And keeping a blacklist opens up the doors to [...] running out your storage [...] because the blacklist will just keep growing. > But why add all this complexity? Just have a whitelist, and you avoid these problems. How does a whitelist helps you there?