5 ms·
>Tokens cannot be deleted. They can only expire. This means that if the token gets leaked, an attacker can misuse it until expiry. Thus, it's important to set t
by tester756 6y ago
>Tokens cannot be deleted. They can only expire. This means that if the token gets leaked, an attacker can misuse it until expiry. Thus, it's important to set token expiry to something very small, like 15 minutes.
But can be black listed.
- mooreds 6y agoSure, or your token issuer could implement https://tools.ietf.org/html/rfc7009 https://tools.ietf.org/html/rfc7009 (if the JWTs are generated using OAuth) or you could build a revocation system. But at that point you've negated one of the two benefits of such tokens. (The other one being you can verify that the contents haven't been modified, since they are signed.) Why not just use session cookies then?
- pier25 6y agoWhich is not stateless