4 ms·
False. OIDC providers expose an API endpoint for early token revocation. Otherwise it would be impossible for users to LOGOUT. The insertion of tons of junk me
by mc4ndr3 5y ago
False. OIDC providers expose an API endpoint for early token revocation. Otherwise it would be impossible for users to LOGOUT.
The insertion of tons of junk metadata in a JWT's claims represents a problem of usage style, not an inherent problem of JWT or OIDC. As a workaround for good data design, the user can be presented with a re-authentication form, where the new token shall replace the old data.
- foxyv 5y agoA logout may just consist of deleting the token in the browser.
- jasfi 5y agoIn Nexus I store tokens in the database. Logging out deletes the record.
- enkrs 5y agoIsn’t that just sessions but with extra steps?
- jasfi 5y agoWell the JWT has encrypted info that is verified on each call, so there is extra security.
- chris37879 5y agoyeah, JWT's are a nice standard way of doing that, but it's functionally not really different than the HTTPS + Session + Nonce pattern that's been in use for about 10 years now, and, provided you pick a secure function to make the hash for the nonce, the nonce may be more secure since it rotates with each payload and the JWT's encryption lasts for its lifetime.
- jasfi 5y agoThe JWTs I use expire after a given time and are renewed. I agree, there's not much difference. Its more like a standard way of generating tokens.
- Spivak 5y agoYep, and if you’re like “if you have to store a revocation/update list then isn’t that just a stateful session again?” Yes but now you only have to store the changed tokens instead of every token — good trick if you’re having trouble scaling Redis.