3 ms·
TL;DR as always, is that there's nothing wrong with JWT. The problem is with thinking that there is a way to have an authentication token that isn't persisted i
by ralusek 5y ago
TL;DR as always, is that there's nothing wrong with JWT. The problem is with thinking that there is a way to have an authentication token that isn't persisted in any way, so long as you want the ability to invalidate a token (i.e. logout, user banned, password change, etc).
- jopython 5y agoRightly said.
- cphoover 5y agoThe difference tho is maintaining a list of user ids you dont accept, a "blackist" (likely very small and each record expires as the token expires). This can be kept in-memory Vs doing a network request to your DB and searching a table that could have millions of rows.
- ralusek 5y agoWell this is what I mean by "persisted in any way." A blacklist is still persistence.