News for hackers. Stuff that matters.
Re:Don't use JSON web tokens for sessions by numbsafari on Monday June 13, 2016 @08:27PM (#11898905)
The point is to avoid all the database updates. So, I would recommend not going that route.

If you need to sign out a user across all logged-in sessions, use a revocation list based on UID, rather than token-id.

Re:Don't use JSON web tokens for sessions by merb on Tuesday June 14, 2016 @12:56PM (#11903359)
yep probably the better idea. eventually we combine sessions and JWT Tokens. The session id is kind of a refresh token that refreshes the token if it was expired and the user didn't generate a new token in less than one minute. than it will use the session id will query the database and create a new token if the session is still valid.