4 ms·
> A "logout" action from the user should just delete the JWT from the device he is using. I wouldn't say should. It may. If you're fine with inability to termi
by orphea 1y ago
> A "logout" action from the user should just delete the JWT from the device he is using.
I wouldn't say should. It may. If you're fine with inability to terminate sessions on other devices.
- littlecranky67 1y agoTerminating sessions on other devices is not possible, but another tradeoff is using a "Logout from all devices" mechanism. In that case you just have a global "token not issue before" field, and when you logout from all devices, set that timestamp to the current time (and all issued tokens will fail authentication). But again, tradeoff. You individual requirements may vary.