4 ms·
One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an
by javajosh 5y ago
One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP.
It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
- jon-wood 5y agoThere’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.
- javajosh 5y ago>blacklisting of revoked tokens Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?
- varenc 5y agoIt's been awhile since I've seen it done that way. I think you're referring to the situation where the API servers authenticate you just by checking signature of a timestamped access token and when the token expires the client fetches a new one. For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.