News for hackers. Stuff that matters.
Re:JWT should not be your default for sessions by e_y_ on Wednesday May 12, 2021 @09:12PM (#27137313)
As the article mentions in a sidenote, a time-bounded revoked sessions table is small enough to keep in memory and can be updated via pubsub for the relatively infrequent case where you need to revoke one.

It's definitely more complex but at certain scales it might be worth it.

Re:JWT should not be your default for sessions by rsj_hn on Wednesday May 12, 2021 @09:26PM (#27137413)
The "keep in memory" part is gonna be hard as you scale to multiple servers. You run into all the issues that lead people to stick an oracle DB behind their app servers. I agree that these considerations do pan out in some cases; I'm not saying that any of these proposals can't be the right way to go depending on your overall design, but now we are squarely in optimization-land and have long given up on statelessness.