News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by JMTQp8lwXL on Friday December 13, 2019 @02:28PM (#21784549)
I wasn't suggesting mutating the signing key multiple times per day or once per 90 seconds. At that point, you might as well just have a very early JWT expiration timestamp specified.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by ceejayoz on Friday December 13, 2019 @02:33PM (#21784600)
The comment thread started with "if you need them to be revocable". Any tool with "a few hundred [enterprise] customers" needs to be able to revoke access for terminated employees, compromised accounts, and the like, and those revocations will occur frequently and in many cases need to have immediate impact.
[ Parent | on HN ]