Re:Don't use JSON web tokens for sessions
by necubi on Monday June 13, 2016 @08:20PM
(#11898867)
There are two common mechanisms for invalidating tokens:
* Store the invalidated tokens in some fast store, in memory store and check that before accepting tokens.
* Have auth tokens be very short lived (e.g., 1 minute) and require the use of a "refresh token" to get a new auth token when it's expired. This is the mechanism used by OAuth 2 (which strangely is never mentioned in the article). The refresh tokens should be random strings stored in a db, and they can be simply deleted on invalidation.
* Store the invalidated tokens in some fast store, in memory store and check that before accepting tokens.
* Have auth tokens be very short lived (e.g., 1 minute) and require the use of a "refresh token" to get a new auth token when it's expired. This is the mechanism used by OAuth 2 (which strangely is never mentioned in the article). The refresh tokens should be random strings stored in a db, and they can be simply deleted on invalidation.