News for hackers. Stuff that matters.

A comment on JSON Web Tokens vs. Sessions. Parent comment

Re:JSON Web Tokens vs. Sessions by jcoffland on Saturday June 18, 2016 @05:11PM (#11930609)
Yes, but this is still a deadend.
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by zbjornson on Sunday June 19, 2016 @12:00PM (#11933390)
How so?

It's effectively a micro-optimization that will have no real effect, but you can do a simple "exists" query when searching the revocation list, and the TTL keeps the collection small.

Not advocating for JWT as it's a silly mess to do everything correctly, but it is possible.

[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by jcoffland on Sunday June 19, 2016 @08:13PM (#11935407)
Searching a revocation list misses the point of RESTful authentication.
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by zimbatm on Monday June 20, 2016 @05:42AM (#11937037)
There is no such thing as a RESTful authentication. REST's design hinges on URIs being public.
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by jcoffland on Friday June 24, 2016 @03:52AM (#11967636)
What do public URIs have to do with it? I don't think we are speaking the same language.
[ Parent | on HN ]