Re:Don't use JSON web tokens for sessions
by homakov on Monday June 13, 2016 @09:41PM
(#11899189)
> Would this "nonce" in the database?
Only in revoked list=1,2,5,7 etc. Unlike storing all sessions, you only store revoked integers which takes way less space and achieves same revocation you wanted.
> That's optimistic
Nobody should store
> leaving themselves vulnerable to old attacks
Every new line of code is probably a vulnerability. That's life. BTW JWT indeed had some super stupid bug with alg=NONE before, and I would simply throw away "header" from JWT
Only in revoked list=1,2,5,7 etc. Unlike storing all sessions, you only store revoked integers which takes way less space and achieves same revocation you wanted.
> That's optimistic
Nobody should store
> leaving themselves vulnerable to old attacks
Every new line of code is probably a vulnerability. That's life. BTW JWT indeed had some super stupid bug with alg=NONE before, and I would simply throw away "header" from JWT