News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by whateveracct on Friday December 13, 2019 @04:45PM (#21785844)
Revoking per-JWT requires state per-JWT, but you can get away with globally-revokable tokens ('logout everywhere' functionality) with a single nonce-per-entity instead of a nonce-per-JWT, which is a bit nicer.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by 0xkalle on Saturday December 14, 2019 @12:31AM (#21787999)
Right.

One point to keep an eye on is, if you are using (e.g.) AWS API Gateway with a custom authorizer, it caches the authentication response for a certain time.

This is not a problem of jwt, but makes the 'logout everywhere' and every black and whitelist need some more time.

[ Parent | on HN ]