3 ms·
This seems like a non issue... Can't you just invalidate existing sessions/tokens immediately when an account is suspended?
by noitpmeder 3y ago
This seems like a non issue... Can't you just invalidate existing sessions/tokens immediately when an account is suspended?
- breadwinner 3y agoIf you're using your own password-based auth then you can. But that has its own issues (such as user has to remember to delete account on your system). If you're using single-sign-on then you have a token from an identity provider such as Microsoft or Google, and then you don't get immediate notification that the user account has been suspended.