3 ms·
How about salt the token with an additional user-specific random string. During log-out, you replace the random string so it no longer matches. Then, we can hav
by kgeist 5y ago
How about salt the token with an additional user-specific random string. During log-out, you replace the random string so it no longer matches. Then, we can have partial check (only signature validation and expiry time) and full check (compare with the salt hitting some store). Full checks can be done only for API calls which deal with sensitive stuff or/and for writes (writes are less common than reads)
For example, fetching an article on something like New York Times would only require a partial check, but the profile page would have full checks.
Does it make sense?
- jayd16 5y agoIf you need to look up the salt for every user on every verify, you're wasting any caching advantage. If you cache the salt, you're reintroducing the cache clearing headaches.
- kgeist 5y agoNot on every verify, that's what full checks are for. The salt isn't saved in the token for caching purposes, it is used to invalidate the token when a user logs out (detected only on full check when salts change). Salt is stored inside the token like other JWT data so it can be ignored for non-sensitive calls (partial check).
- deleted 5y ago[deleted]