Re:Web Authentication: Proposed API for accessing Public Key...
by ecesena on Tuesday April 10, 2018 @02:56PM
(#16804043)
Nor you can today - a completely untrusted computer could fake the logout experience and keep a valid access token.
All signed access token, when logged out or revoked, should be marked so on the server side. Of course the untrusted computer should at the very least send the logout request.
Typically, a service should also let you see all your active sessions and let you revoke them.
All signed access token, when logged out or revoked, should be marked so on the server side. Of course the untrusted computer should at the very least send the logout request.
Typically, a service should also let you see all your active sessions and let you revoke them.