Re:JSON Web Tokens vs. Sessions
by nneonneo on Saturday June 18, 2016 @01:55PM
(#11929776)
If the user reauthenticates and you unset the reauth flag, wouldn't their previous sessions (e.g. tokens held by an attacker) suddenly become valid again? How would you prevent such an attack?
[ Parent
| on HN ]
Re:JSON Web Tokens vs. Sessions
by inopinatus on Saturday June 18, 2016 @02:01PM
(#11929813)
You wouldn't use a boolean flag. I suggest setting a validity timestamp for the user, and reject any token that was issued-at any earlier time.
(This isn't a perfect scheme since a compromised issuer could have been induced to send post-dated tokens. If your need for global logout was to invalidate tokens issued by a compromised issuer, you'll need to blacklist keys as well)