4 ms·
Rather than blacklist JTIs would it not be simpler to keep a valid after date on the user? Any token issued before that date is not acceptable
by mikeymz 7y ago
Rather than blacklist JTIs would it not be simpler to keep a valid after date on the user? Any token issued before that date is not acceptable
- mgraczyk 7y agoThen you can't have users sign out of device A while remaining signed into device B.