3 ms·
Yeah, but how would you log a user out? Delete the local token? And if someone got access to the token, your account will be owned forever with no way to revoke
by y4mi 7y ago
Yeah, but how would you log a user out? Delete the local token?
And if someone got access to the token, your account will be owned forever with no way to revoke the access. Unless you auto expire them... Now you need a flow to refresh the tokens....
If you implement jwt, you will need sessions and all other features authentication servers have... It would be way easier to implement a custom authentication flows mimicking your email auth than recreating everything else.
I think your service is good as is and introducing jwt to it would be a net-negative
But I'm just a random person from the internet, do whatever you feel like doing ;)
- anderspitman 7y agoSorry, I didn't notice you had responded. I think maybe you're reading too much into adding JWTs to emauth.io. It simply provides another source of information, ie that as of a certain time, emauth.io verifies that the holder of this token had control over the email address. Implementations can do whatever they want with that information, depending on their threat model. And since previously the API was returning a fairly redundant text response (status code already tells you whether verification was successful), returning the JWT doesn't interfere with the previous functionality.