2 ms·
> And if he got his JWT stolen before logout, bah anyway any token could have been stolen that way, whatever the tech. The thing is, with the good old "token i
by pjerem 2y ago
> And if he got his JWT stolen before logout, bah anyway any token could have been stolen that way, whatever the tech.
The thing is, with the good old "token in the database" method, logging out means deleting the token from the database so no, you can’t reuse a stolen token after a logout.
- gkbrk 2y agoIf the user can somehow get their token stolen from the browser, they can also get their username/password stolen from the browser.
- sweetjuly 2y agoPlus, a compromised browser could just block the logout request. It's a nonsense and indefensible threat model. If you need to worry about compromised browsers, you need a mitigation which doesn't rely on the browser or that'd be easily compromised by someone who could compromise the browser. It's a slightly different story with a "logout all sessions" button where the user might press it from a trusted device, but that's a different functionality than a logout button. There you would need revocation, but if you (like many websites) don't actually support this functionality you really don't even need to support a logout functionality more complex than just asking the client nicely to please delete the token.