Re:Show HN: OAuth microservice for FB, Twitter, etc.
by nathancahill on Tuesday July 04, 2017 @03:14PM
(#14697700)
Expired can happen clientside, just check the timestamp. Revoked would be a short blacklist that lasts the duration of the session, once a token is expired it no longer has to be revoked.
But I'm also curious how a revoked list would be handled with this service.
Re:Show HN: OAuth microservice for FB, Twitter, etc.
by hultner on Wednesday July 05, 2017 @05:50AM
(#14701076)
That's only true if you do not allow for long running sessions which are commonplace today. And it still requires a lookup every time to see if a particular session is blacklisted.
From what I could grasp there's no mechanics for blacklists/revocations in the current implementation of this service.
From my prior research this seems to be a problem with the JWT which would either require distribution of ever growing blacklists or session verification through shared server side sessions.
Would also love to see some API documentation.
I really like the idea and always reimplementing login services seems like unnecessary hassle.