2 ms·
I did exactly this on the last implementation of JWT I did. Common actions wouldn’t hit the database if the token was less than an hour old, but actions like ch
by mwilliaams 7y ago
I did exactly this on the last implementation of JWT I did. Common actions wouldn’t hit the database if the token was less than an hour old, but actions like changing email address or password would always check the database.
- user5994461 7y agoThis just made me realize. There is an even simpler way to achieve the same result without a database. The token includes the time when it was created (iat attribute) so critical actions could check that the token is less than 3 minutes old.
- mwilliaams 7y agoYeah that’s what I did, with iat info. But I did that for every request, and critical actions always hit the db.