3 ms·
If your environment is such that 5 minutes of lag between logout end a token being invalidated, you can always just verify the token against the auth server per
by spookthesunset 5y ago
If your environment is such that 5 minutes of lag between logout end a token being invalidated, you can always just verify the token against the auth server per request.
JWT comes in handy for most of your site where it isn’t such a big deal. That way you aren’t flooding your auth server with calls; all your web servers can just validate the token themselves up until a refresh is required.
Basically JWT let’s you have your cake and eat it too. Significantly less load on your auth backend while still letting sensitive parts of the site verify on every request.
- ryan-allen 5y agoI don't understand why people are down-voting you.
- spookthesunset 5y agoBecause a lot of people see security in terms of black and white instead of a lot of shades of gray. Not everything requiring authentication is your bank account. HN, for example, could have even a 10 minute window and be okay. Not having to block all your request waiting for the auth backend can improve your latency by a non-trivial amount. It also can make your auth server much less complex. JWT is awesome. People just think it is "all or nothing" and implement it wrong.
- ryan-allen 5y ago> JWT is awesome. That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how paranoid the org felt about certain things. Having worked on PHP/Rails/.NET Webforms/Node.js apis/C# webapis the session management techniques are all very different. Having run high traffic websites also, the ability to offload logged-in sessions into JWT was really, really nice. Not having to prune auto-generated sessions from disk of PHP applications is a nice thing to not worry about.