Re:JWT should not be your default for sessions
by lbriner on Thursday May 13, 2021 @03:31AM
(#27139388)
It depends on what auth you are using.
In OpenID Connect, there are back channels that talk to each other so that all devices know you have logged out.
If you are using traditional auth then yes, you would need to track session state against the user so that when they access from a particular device, you could check whether they have already logged out.
Some more complex apps use a background thread to check auth status with the server.
In OpenID Connect, there are back channels that talk to each other so that all devices know you have logged out.
If you are using traditional auth then yes, you would need to track session state against the user so that when they access from a particular device, you could check whether they have already logged out.
Some more complex apps use a background thread to check auth status with the server.