News for hackers. Stuff that matters.

A comment on JSON Web Tokens should be avoided. Parent comment

Re:JSON Web Tokens should be avoided by unscaled on Tuesday March 14, 2017 @11:39AM (#13868379)
Agreed. Revoking all user sessions instead of a specific token is the common case. The only usage I see for revoking a specific token is when the user is deactivating a specific client.
[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by nb777 on Wednesday March 15, 2017 @08:30AM (#13875609)
Also when a user changes his password, no ?
[ Parent | on HN ]