4 ms·
Which is not checking on-request. If a token is invalidated, it must be rejected inline. Otherwise, you're just fucking around. Which, if you aren't doing anyth
by eropple 7y ago
Which is not checking on-request. If a token is invalidated, it must be rejected inline. Otherwise, you're just fucking around. Which, if you aren't doing anything important, sure, fine--the problem is that most of the folks who leap to poorly-specified jank like JWT are doing important things with tools they don't understand and the people that are impacted are downstream of them.
- magicalhippo 7y agoNot sure what you mean, and I might have explained their setup wrongly, I'm no expert in this. I ask for an access token from auth server, I pass access token to API server, API server optionally checks with auth server if token is ok, or if token is self-contained, verifies signature, checks expiration time etc. Obviously self-contained tokens cannot be revoked, they can only expire. For this service, JWT is used when requesting an access token, and as an access token for self-contained tokens.