News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by martin-adams on Thursday November 01, 2018 @11:09AM (#18354619)
>> Fine, revoke the master token on the authentication server and after 5 minutes at the latest

That might be fine for a lot of use cases. But anything that can steal money using that token and 5 minutes is a very long time indeed.

[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by mschuster91 on Thursday November 01, 2018 @04:00PM (#18357834) 

    But anything that can steal money using that token and 5 minutes is a very long time indeed.
Then implement a check for the token in destructive operations. Should keep the performance impact pretty low.
[ Parent | on HN ]