Re:Revoking JWTs (JSON Web Tokens)
by amaccuish on Thursday January 31, 2019 @03:59PM
(#19048794)
Most systems use this method but over two tokens, usually referred to as a session/access token and a refresh token. See OAUTH.
[ Parent
| on HN ]
Re:Revoking JWTs (JSON Web Tokens)
by brokenwren on Thursday January 31, 2019 @04:02PM
(#19048822)
Exactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.
I'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration".
Obviously the renewal service would need to be able to sign the new/extended token.