3 ms·
If you need to look up the salt for every user on every verify, you're wasting any caching advantage. If you cache the salt, you're reintroducing the cache cle
by jayd16 6y ago
If you need to look up the salt for every user on every verify, you're wasting any caching advantage. If you cache the salt, you're reintroducing the cache clearing headaches.
- kgeist 6y agoNot on every verify, that's what full checks are for. The salt isn't saved in the token for caching purposes, it is used to invalidate the token when a user logs out (detected only on full check when salts change). Salt is stored inside the token like other JWT data so it can be ignored for non-sensitive calls (partial check).
- deleted 6y ago[deleted]