JWT should not be your default for sessions

Re:JWT should not be your default for sessions by ryanmarsh on Thursday May 13, 2021 @12:08AM (#27138291)

I’ve only done a few JWT implementations so forgive my ignorance but isn’t this what “exp” and token refreshes are for?

If you don’t want to maintain a centralized session store and you don’t want long lived tokens just set the expiry to 90 seconds. When you attempt a refresh, if the user is logged out it will fail.

I’m really confused by the either/or of “hit central session store on every request” or “tokens that live five minute too long are bad mmmkay”.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by josephg on Thursday May 13, 2021 @02:03AM (#27138938)

Huh? To track if the user is logged in (for longer than 90 seconds) you’ll need another token, used to refresh the JWT token. And you’ll need the normal session infrastructure to validate that anyway.

That sounds like a very complex system to cache session tokens. You may as well just cache normal session tokens for 90 seconds in your application servers. Same result, less complexity.

[ Parent | on HN ]