3 ms·
I don't see why you need a revocation list - you just need to check access date with the security key. And do a sweep say every couple of hours to delete the se
by zabzonk 5y ago
I don't see why you need a revocation list - you just need to check access date with the security key. And do a sweep say every couple of hours to delete the security keys that haven't been used.
- danbulant 5y agoIf a user decides to logout from certain device, or when you need to log out an active session early
- Sirened 5y agoRevocation is important for SSO and, generally, on corporate systems. When you fire an employee and suspend their systems access, you really don't want a dangling session token to be useable, so you need to support early revocation. The revocation lists will be comparatively very small and so distributing them is less of a challenge. It's mostly just a pain.