News for hackers. Stuff that matters.
Re:Don't use JSON web tokens for sessions by ForHackernews on Monday June 13, 2016 @11:33PM (#11899566)
Can you explain this a little bit more? You keep a counter on the user object in the DB? What is the JWT buying you if you still have to hit the DB on every request?
Re:Don't use JSON web tokens for sessions by mstade on Tuesday June 14, 2016 @08:59AM (#11901705)
Presumably you can keep counters like these on the server edges, and just push new values out to servers whenever things change, as opposed to query a DB every time. This wouldn't invalidate individual tokens however, but all tokens that have that counter value. It'd also mean there's a window where tokens can still be used while servers are being updated with the new value(s).

These are just some random and half-baked thoughts, I have no idea what OP does, but there are options to limit hitting backing DBs anyway.