News for hackers. Stuff that matters.

A comment on A practical proposal for migrating to safe long sessions on the web. Parent comment

Re:A practical proposal for migrating to safe long sessions ... by StavrosK on Thursday July 21, 2016 @07:31PM (#12140777)
Isn't the original problem that someone could steal the long-lived cookie in the first place?
[ Parent | on HN ]
Re:A practical proposal for migrating to safe long sessions ... by crashedsnow on Thursday July 21, 2016 @10:20PM (#12141337)
The intent is not to provide an "unstealable" token, but a revocable one. You can't (don't need to) revoke the refresh token but you can revoke the access token by disallowing refresh.
[ Parent | on HN ]
Re:A practical proposal for migrating to safe long sessions ... by true_religion on Thursday July 21, 2016 @10:14PM (#12141320)
The long term cookie requires authentication from a service (e.g. maybe a database backed session), and the service can invalidate a particular cookie on logout, or by user request.
[ Parent | on HN ]