Re:JSON Web Tokens vs. Sessions
by kensign on Saturday June 18, 2016 @04:28PM
(#11930473)
use a ttl on like a cache store, such as redis
[ Parent
| on HN ]
Yes, but this is still a deadend.
How so?
It's effectively a micro-optimization that will have no real effect, but you can do a simple "exists" query when searching the revocation list, and the TTL keeps the collection small.
Not advocating for JWT as it's a silly mess to do everything correctly, but it is possible.
Searching a revocation list misses the point of RESTful authentication.
There is no such thing as a RESTful authentication. REST's design hinges on URIs being public.