Re:Stop using JWT for sessions (2016)
by Alex3917 on Thursday November 01, 2018 @03:05PM
(#18357317)
> Updating the 'date_password_last_changed' will invalidate all the tokens for a user.
If someone is changing their password because it has potentially been compromised, what is a scenario where you would not want to invalidate all of their existing tokens?
If someone is changing their password because it has potentially been compromised, what is a scenario where you would not want to invalidate all of their existing tokens?