2 ms·
How does that help? You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check. There won't b
by lbriner 5y ago
How does that help? You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check. There won't be many that are called with expired tokens compared with people using the site constantly and always having valid tokens.
- bobthebuilders 5y agoYou don't need a DB. The same in memory stuff that supposedly works for fast session auth works here too.
- ecnahc515 5y ago> You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check You can verify the signature before calling the DB.
- giaour 5y agoYou can push a list of revoked tokens to each server (similar to how certificate revocation lists work with (m)TLS).