3 ms·
> But at that point, it's no longer stateless. Isn't that what you want ? You seem to be agreeing that JWTs don't have state baked in, but can be tracked to t
by makeitdouble 5y ago
> But at that point, it's no longer stateless.
Isn't that what you want ?
You seem to be agreeing that JWTs don't have state baked in, but can be tracked to the granularity you want, to adjust for your specific use case.
Also I'd be a proponent of tracking all the valid tokens if you care about invalidation, it gives more flexibility and you can report to your user their connected apps/devices.
On the general point, I think it's easier to add state and context to a system than to remove it, so I kinda agree with the tradeoff of having no state by default, even if for most public facing applications low granularity tracking will be needed.
- Sohcahtoa82 5y agoI think we're in agreement. We need our session tokens (Whether a random session ID or a JWT) to be able to be invalidated, which requires server-side state, but proponents of JWTs advertise statelessness as being a feature. Granted, with JWTs, you'd only need to store a blacklist of invalidated tokens, whereas with plain session IDs, you need a database storing the data for every active session, so JWTs can still be used to minimize state.