natelaporte

4 ms·

1. 1.▲
   by natelaporte 10y ago

   This is unacceptable. How can you be proud of cheating to win?
2. 2.▲
   by natelaporte 11y ago

   Even with the exp claim if the user saves the token before they log out they can reuse it until it actually expires, you have to generate jtis and store them in a blacklist which is what the author of the article meant (you still have to ha
3. 3.▲
   by natelaporte 11y ago

   Why can't you just change the secret on the server? It would invalidate all sessions.