JWT should not be your default for sessions

Re:JWT should not be your default for sessions by lbriner on Thursday May 13, 2021 @03:28AM (#27139370)

How does that help? You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check. There won't be many that are called with expired tokens compared with people using the site constantly and always having valid tokens.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by bobthebuilders on Thursday May 13, 2021 @01:48PM (#27145021)

You don't need a DB. The same in memory stuff that supposedly works for fast session auth works here too.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by ecnahc515 on Thursday May 13, 2021 @05:33PM (#27147755)

> You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check

You can verify the signature before calling the DB.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by giaour on Thursday May 13, 2021 @06:18PM (#27148197)

You can push a list of revoked tokens to each server (similar to how certificate revocation lists work with (m)TLS).

[ Parent | on HN ]