Peach App Token Reuse Flaw

Re:Peach App Token Reuse Flaw by Alex3917 on Monday January 18, 2016 @09:03PM (#10928442)

> While I agree that the tokens must be expired on logout

Is there really that much additional security over deleting tokens locally when logging out, but expiring all existing tokens (using a timestamp) on password change?

Blacklisting individual tokens requires storing them in the db and then looking them up each time a user logs in. It seems like given the app already uses TLS, the tiny security gain isn't big enough to justify the performance impact.

[ Parent | on HN ]

Re:Peach App Token Reuse Flaw by dwightgunning on Tuesday January 19, 2016 @03:59AM (#10929449)

I agree although I think about it more in terms of development and maintenance effort.

There's plenty of other relatively computationally and IO intensive activity happening during login so I can't see an extra select having a tangible impact to performance.

[ Parent | on HN ]

Re:Peach App Token Reuse Flaw by Alex3917 on Tuesday January 19, 2016 @08:21AM (#10930499)

The issue isn't tokens getting created on login, it's them getting validated on every request. That's already 40-50ms, even without the db hit each time.

[ Parent | on HN ]