News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by tschellenbach on Thursday November 01, 2018 @12:21PM (#18355548)
The article exaggerates these issues. Also there are easy solutions available for those concerns.

It's trivial to store a token version on your user object and invalidate any token that has the wrong version.

[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by dchest on Thursday November 01, 2018 @12:42PM (#18355810)
Then just store session ID there and get rid of JWT.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by indeyets on Thursday November 01, 2018 @12:55PM (#18355969)
There's big difference between fetching session from db and validating id via short local (push distributed) revoke list. Well, that's if project is large enough to saturate storage :)
[ Parent | on HN ]