News for hackers. Stuff that matters.

A comment on Revoking JWTs (JSON Web Tokens). Parent comment

Re:Revoking JWTs (JSON Web Tokens) by brokenwren on Thursday January 31, 2019 @04:02PM (#19048822)
Exactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.
[ Parent | on HN ]
Re:Revoking JWTs (JSON Web Tokens) by e12e on Friday February 01, 2019 @12:42AM (#19051945)
I'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration".

Obviously the renewal service would need to be able to sign the new/extended token.

[ Parent | on HN ]