News for hackers. Stuff that matters.
Re:Ask HN: What's the current sentiment on JWT for stateless... by mgraczyk on Friday December 13, 2019 @09:16PM (#21787346)
The state necessary to revoke JWTs is easier to manage than session state.

1. It's small (id per revoked, nonexpired JWT)

2. It isn't sensitive, nobody learns anything by seeing the list of revoked JWT ids.

3. It's monotonic. You just maintain a set that you add to. You can clean up expired tokens if you want but that's not necessary for correctness.

These three items make bugs less likely and make it easier to manage consistency when you can't afford to use transactions everywhere.

Re:Ask HN: What's the current sentiment on JWT for stateless... by namibj on Saturday December 14, 2019 @12:19AM (#21787960)
The monotonicity alone makes the required state _very_ easy. Adding (timestamp, jwt_id) pairs to a monotonic set which you occasionally switch over to a second, fresh set (checking against both, adding to one) requires zero coordination in the critical path. The only coordination required is about when the sets are switched, where you need to ensure that you leave ample time for old JWTs to expire before clearing the corresponding revocation set entries.
Re:Ask HN: What's the current sentiment on JWT for stateless... by mikeymz on Saturday December 14, 2019 @05:13AM (#21788735)
Rather than blacklist JTIs would it not be simpler to keep a valid after date on the user? Any token issued before that date is not acceptable
Re:Ask HN: What's the current sentiment on JWT for stateless... by mgraczyk on Saturday December 14, 2019 @04:59PM (#21792584)
Then you can't have users sign out of device A while remaining signed into device B.