2 ms·

You either reissue tokens constantly, every couple minutes or so, or you have to reliably invalidate.

• tasuki 5mo ago
  Maybe you do. Why would I have to do that?
  • tptacek 5mo ago
    Because it's bad to ship products where a compromised token can never be recovered from. Revocation is the essential hard problem in authentication/authorization.
    • tasuki 5mo ago
      I guess I just can't see the actual path here. How does a token get compromised in a way the victim finds out before the attacker makes ample use of the compromised token? From my pov, when the token gets compromised, you've lost already. Note the auth systems I create usually do not process payment info and contain very little personal information (an email). I still think I'm fine without revocation mechanisms.