News for hackers. Stuff that matters.

A comment on Ask HN: What is the best way to add authentication to REST API (for mobile)?. Parent comment

Re:Ask HN: What is the best way to add authentication to RES... by etherealkatana on Tuesday January 01, 2019 @01:42PM (#18801533)
Can you please elaborate on this?
[ Parent | on HN ]
Re:Ask HN: What is the best way to add authentication to RES... by geezerjay on Tuesday January 01, 2019 @02:19PM (#18801725)
The JWT specification defines a payload attribute named jti which is used to store the token's nonce/id.

To avoid replay attacks, the backend adds the token's nonce to a scratchpad memory when the token is used in order to invalidate the token even if the expiration timestamp isn't reached.

If a JWT implementation is implemented to ignore replay attacks or even token expiration, the jti can still be used to invalidate tokens.

[ Parent | on HN ]