Re:JWT should not be your default for sessions
by xyzzy123 on Thursday May 13, 2021 @12:42AM
(#27138492)
Agree, a lot of webapps can just ignore. Suppose you have a 10 min refresh time. Logout just deletes the client-side state and in 10 minutes the user will be "hard" logged out since their token hasn't been refreshed.
Similar security to "abandoned session" which is of course what a very large % of users do instead of "logging out".
There is risk of cloned session, but there's no law saying non-banking apps have to care.
This has the nice property that if you're forced to, adding a cache to store invalidated tokens with a ttl of 10 minutes is an incremental enhancement.
Similar security to "abandoned session" which is of course what a very large % of users do instead of "logging out".
There is risk of cloned session, but there's no law saying non-banking apps have to care.
This has the nice property that if you're forced to, adding a cache to store invalidated tokens with a ttl of 10 minutes is an incremental enhancement.