Revoking JWTs (JSON Web Tokens)

Re:Revoking JWTs (JSON Web Tokens) by e12e on Thursday January 31, 2019 @03:56PM (#19048773)

Anyone do the kerberos way, with two lifetimes? In theory this allows one time authentication, paired with continuous renewal - where refusing renewal becomes a way to invalidate the session/ticket (by way of expiration):

https://stackoverflow.com/questions/14682153/lifetime-of-ker...

Ed: Note that the service doing the renewal won't need the user/password - only a way to check if the user is blacklisted, as well as a way to sign/make tokens - and doesn't have to be the same system that issues the initial token.

[ Parent | on HN ]

Re:Revoking JWTs (JSON Web Tokens) by amaccuish on Thursday January 31, 2019 @03:59PM (#19048794)

Most systems use this method but over two tokens, usually referred to as a session/access token and a refresh token. See OAUTH.

[ Parent | on HN ]

Re:Revoking JWTs (JSON Web Tokens) by brokenwren on Thursday January 31, 2019 @04:02PM (#19048822)

Exactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.

[ Parent | on HN ]

Re:Revoking JWTs (JSON Web Tokens) by e12e on Friday February 01, 2019 @12:42AM (#19051945)

I'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration".

Obviously the renewal service would need to be able to sign the new/extended token.

[ Parent | on HN ]