Re:Ask HN: What's the current sentiment on JWT for stateless...
by jchw on Friday December 13, 2019 @02:49PM
(#21784750)
Don’t see the word “refresh” in there. Guessing they are assuming you use JWT identically to how you might use a session cookie, which is not how I’ve ever seen it used, personally.
[ Parent
| on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless...
by jayd16 on Friday December 13, 2019 @03:39PM
(#21785214)
In the diagram in the bottom right they seem to think you cannot revoke the long term token. I agree that it doesn't align with my understanding of whats capable with oauth2 style tokens, for example.
Re:Ask HN: What's the current sentiment on JWT for stateless...
by cstrahan on Friday December 13, 2019 @04:28PM
(#21785688)
That box should probably read: “You can't revoke the long-term tokens in a stateless manner, so supposing you truly manage ZERO state, then you're back to square one.”
That seems like the charitable interpretation. Note that the author’s point has not been that JWT is useless, but rather that trying to use stateless JWT for sessions is a bad idea.
If the point of using for JWT was to avoid all server side state in authn/authz flow — which is the case for many, many developers, and that is the intended audience of the author’s post — then one of two things: you either contradict yourself and implement server side revocation for refresh tokens, or you let the lifetime of your sessions be the same as the refresh token — and in the case of refresh tokens with no expiry, the user (or anyone with their refresh token) can stay logged in forever.