News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by davidwparker on Thursday November 01, 2018 @12:01PM (#18355300)
Why are checking against the DB here? Parent said a constant. You'd just check the constant value within the JWT vs the constant on the backend, and update the backend constant to invalidate.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by the_af on Thursday November 01, 2018 @12:30PM (#18355676)
(Correct me if I misunderstand you)

If you check against a single constant in the backend, are you invalidating all JWTs for all users whenever you want to invalidate only one? Even if you keep a blacklist of invalidated JWTs, how do you keep it up to date? How do you distribute it? What happens if the blacklist becomes unavailable for whatever reasons?

[ Parent | on HN ]