Ask HN: What is the best way to add authentication to REST API (for mobile)?

Re:Ask HN: What is the best way to add authentication to RES... by nerdwaller on Tuesday January 01, 2019 @09:42AM (#18800346)

To clarify for JWT invalidation, you don’t have to store the whole token. Instead just store the jti or some other identifying field that can be checked.

[ Parent | on HN ]

Re:Ask HN: What is the best way to add authentication to RES... by etherealkatana on Tuesday January 01, 2019 @01:42PM (#18801533)

Can you please elaborate on this?

[ Parent | on HN ]

Re:Ask HN: What is the best way to add authentication to RES... by geezerjay on Tuesday January 01, 2019 @02:19PM (#18801725)

The JWT specification defines a payload attribute named jti which is used to store the token's nonce/id.

To avoid replay attacks, the backend adds the token's nonce to a scratchpad memory when the token is used in order to invalidate the token even if the expiration timestamp isn't reached.

If a JWT implementation is implemented to ignore replay attacks or even token expiration, the jti can still be used to invalidate tokens.

[ Parent | on HN ]