4 ms·
JWTs expire, so you only need to maintain a list of invalidated JWTs that haven't expired yet. You get two short cuts, one that you only check for revoked token
by ecnahc515 5y ago
JWTs expire, so you only need to maintain a list of invalidated JWTs that haven't expired yet. You get two short cuts, one that you only check for revoked tokens which aren't expired and have valid signatures. This can save a lot of DB queries given you usually have to check auth validity per request.
- lbriner 5y agoHow does that help? You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check. There won't be many that are called with expired tokens compared with people using the site constantly and always having valid tokens.
- bobthebuilders 5y agoYou don't need a DB. The same in memory stuff that supposedly works for fast session auth works here too.
- ecnahc515 5y ago> You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check You can verify the signature before calling the DB.
- giaour 5y agoYou can push a list of revoked tokens to each server (similar to how certificate revocation lists work with (m)TLS).