Re:Don't use JSON web tokens for sessions
by mwpmaybe on Monday June 13, 2016 @05:57PM
(#11898057)
Invalidating the site secret is my go-to strategy right now, but I have wondered how to sign out a single user across all their logged-in devices. Anyway, this idea is interesting and would be pretty straightforward to implement. Thanks!
[ Parent
| on HN ]
Re:Don't use JSON web tokens for sessions
by numbsafari on Monday June 13, 2016 @08:27PM
(#11898905)
The point is to avoid all the database updates. So, I would recommend not going that route.
If you need to sign out a user across all logged-in sessions, use a revocation list based on UID, rather than token-id.
yep probably the better idea.
eventually we combine sessions and JWT Tokens.
The session id is kind of a refresh token that refreshes the token if it was expired and the user didn't generate a new token in less than one minute. than it will use the session id will query the database and create a new token if the session is still valid.
Maybe you could salt the secret per user and store it in the DB. This would allow users to have a feature like "Logout from all devices". I am not sure how you would query the database to get the salt? JWT as key and salt as value? Or maybe sending userId with each request?
Anyone know any good articles I can read on the topic?