Re:JSON Web Tokens vs. Sessions
by btdiehr on Saturday June 18, 2016 @01:16PM
(#11929537)
Why do you think you can't invalidate a JWT? Store a JWT that is associated with some object in a database that has the field `isInvalidated`. This isn't rocket science. Sure - this turns the JWT token into a session but there is no way to invalidate based on something that isn't determined at creation time without storing something in a database.
[ Parent
| on HN ]
What's the point of using a JWT if so? This effectively converts it into a session token
Re:JSON Web Tokens vs. Sessions
by baseonmars on Sunday June 19, 2016 @12:07PM
(#11933415)
You can create a JWT without writing to a datastore - this is a key difference.
use a ttl on like a cache store, such as redis
Yes, but this is still a deadend.
How so?
It's effectively a micro-optimization that will have no real effect, but you can do a simple "exists" query when searching the revocation list, and the TTL keeps the collection small.
Not advocating for JWT as it's a silly mess to do everything correctly, but it is possible.
Searching a revocation list misses the point of RESTful authentication.
There is no such thing as a RESTful authentication. REST's design hinges on URIs being public.