News for hackers. Stuff that matters.

A comment on Show HN: OAuth microservice for FB, Twitter, etc.. Parent comment

Re:Show HN: OAuth microservice for FB, Twitter, etc. by nathancahill on Tuesday July 04, 2017 @03:14PM (#14697700)
Expired can happen clientside, just check the timestamp. Revoked would be a short blacklist that lasts the duration of the session, once a token is expired it no longer has to be revoked.

But I'm also curious how a revoked list would be handled with this service.

[ Parent | on HN ]
Re:Show HN: OAuth microservice for FB, Twitter, etc. by hultner on Wednesday July 05, 2017 @05:50AM (#14701076)
That's only true if you do not allow for long running sessions which are commonplace today. And it still requires a lookup every time to see if a particular session is blacklisted.

From what I could grasp there's no mechanics for blacklists/revocations in the current implementation of this service.

[ Parent | on HN ]