News for hackers. Stuff that matters.
Re:Stop using JWT for sessions (2016) by ThePhysicist on Thursday November 01, 2018 @11:11AM (#18354650)
If you assume that token invalidation happens infrequently it can still be easier to create a communication channel from individual clients/services to the authentication API through which they receive revocation requests/lists than to check every access token explicitly using a combination of API requests and caching (which also introduces invalidation delay). I'd say it really depends on how many requests per second you need to serve, how your architecture looks and how often you have to invalidate tokens.

I can definitely see the appeal of JWT tokens for infrastructures with many decentralized services and a very high request load, even when taking into account the added complexity due to invalidation issues.

There are no comments on this comment yet.