3 ms·
Hmmm...put the expiration datetime in the token and have your middleware handle it (verify and check for expiration)? Failing to see a problem.
by datavirtue 4y ago
Hmmm...put the expiration datetime in the token and have your middleware handle it (verify and check for expiration)?
Failing to see a problem.
- jdthedisciple 4y agoThat's already done. The problem is that apart from expiration, the token is never invalidated, for example when the user logs out. An attacker who stole the JWT is still logged into the victim's account until expiration.