2 ms·

There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not

There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.

javajosh 5y ago
>blacklisting of revoked tokens Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?