News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by TheFiend7 on Friday December 13, 2019 @02:24PM (#21784508)
Man I'm not sure I agree with that. Blowing up a bunch of your clients that rely on your services randomly because one account was compromised is not acceptable for really any professional business regardless of the number of clients.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by JMTQp8lwXL on Friday December 13, 2019 @02:26PM (#21784529)
"Blowing them up" is a mischaracterization of the situation. You are not mutating their data. You're only asking them to login again.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by SkyPuncher on Friday December 13, 2019 @05:12PM (#21786081)
Actually blowing them up is a completely appropriate description if you have any non-human's relying on JWTs.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by onion2k on Saturday December 14, 2019 @03:56AM (#21788536)
Applications that use authenticated services need to handle being the authentication being revoked. That's fairly obvious regardless of how it happens. If your app doesn't then it's broken.
[ Parent | on HN ]