3 ms·
> don't cache your user/auth database, but have a distributed cache of JWTs that have been revoked My understanding was that this is the ENTIRE benefit of JWTs
by nicoburns 2y ago
> don't cache your user/auth database, but have a distributed cache of JWTs that have been revoked
My understanding was that this is the ENTIRE benefit of JWTs (over plain session token): they allow you go from a allowlist to a blocklist, which is more efficient at really large scales because you only have to store expired sessions (until their time-limit expires) rather than every session).
And if you're not doing this then there's no point in using JWTs (which will be the case for most people).
Are there any other benefits I'm missing?
- andrewmcwatters 2y ago> you only have to store expired sessions (until their time-limit expires) rather than every session). I don’t know of any companies that even do this. As far as I know, most use cases store nothing, except for of course the client storing the response.