3 ms·
An insanity has just occured to me: you could update (i.e. regenerate) the user's ID to invalidate tokens, fixing the logout issue and keeping the architecture
by haolez 5y ago
An insanity has just occured to me: you could update (i.e. regenerate) the user's ID to invalidate tokens, fixing the logout issue and keeping the architecture stateless :)
- SkyPuncher 5y agoWow. This is a great idea.
- treve 5y agoThis implies you would also need to know if the user ID exists before you use it, which means a look up. (because it might be 'regenerated' and no longer valid). If you take that one step further and just introduce disposable user ids, that point to a "real" user id, you've basically reinvented the session ID.
- haolez 5y agoThat's the same as when you have a "normal" user ID in the token. You have to bind the request to your user's data _somewhere_.