JWT should not be your default for sessions

Re:JWT should not be your default for sessions by ecnahc515 on Wednesday May 12, 2021 @09:29PM (#27137427)

JWTs expire, so you only need to maintain a list of invalidated JWTs that haven't expired yet. You get two short cuts, one that you only check for revoked tokens which aren't expired and have valid signatures. This can save a lot of DB queries given you usually have to check auth validity per request.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by lbriner on Thursday May 13, 2021 @03:28AM (#27139370)

How does that help? You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check. There won't be many that are called with expired tokens compared with people using the site constantly and always having valid tokens.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by bobthebuilders on Thursday May 13, 2021 @01:48PM (#27145021)

You don't need a DB. The same in memory stuff that supposedly works for fast session auth works here too.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by ecnahc515 on Thursday May 13, 2021 @05:33PM (#27147755)

> You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check

You can verify the signature before calling the DB.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by giaour on Thursday May 13, 2021 @06:18PM (#27148197)

You can push a list of revoked tokens to each server (similar to how certificate revocation lists work with (m)TLS).

[ Parent | on HN ]