News for hackers. Stuff that matters.
Re:Revoking JWTs (JSON Web Tokens) by dwaite on Thursday January 31, 2019 @02:44PM (#19048056)
FWIW, I discourage the use of Webhooks (mentioned in the article) because they aren't reliable. An application cannot easily detect if a logic or network issue has caused it to stop recognizing invalid tokens.
Re:Revoking JWTs (JSON Web Tokens) by brokenwren on Thursday January 31, 2019 @03:18PM (#19048388)
I'll add on to what @robotdan mentioned. A distributed cache is basically a Webhook approach to pushing cached values around. If your Webhooks (or whatever you want to call them really) are transactional, then the state sync is handled and guaranteed by the nature of events and the server generating them.
Re:Revoking JWTs (JSON Web Tokens) by robotdan on Thursday January 31, 2019 @03:12PM (#19048332)
Adding a transaction around the webhook could help with this. At least you'd know for sure everyone has agreed upon the state of the user.

But agreed, webooks in general are not excellent for critical events in general unless there are additional ways and of confirming receipt and confirmation.