JWT Tokens are NOT safe

Re:JWT Tokens are NOT safe by ibraheemdev on Thursday June 24, 2021 @10:47PM (#27626639)

For 2 and 3 I was mainly referring to Identity, although I'm not sure how it works internally. For 1, I think the main issue is that when someone logs out, or you log someone out, you aren't guaranteed that they are actually logged out. There are cases where this does matter.

How does Devise handle 'revoke all sessions for this user'?

[ Parent | on HN ]

Re:JWT Tokens are NOT safe by spect88 on Thursday June 24, 2021 @11:48PM (#27626955)

> How does Devise handle 'revoke all sessions for this user'?

The cookie has both user id and a special token which IIRC is a substring of the user's password salt. Retrieving current user from cookie includes not only looking up by id, but also verifying the salt. So if you change the password, the salt is also changed and all the old sessions will stop working.

[ Parent | on HN ]

Re:JWT Tokens are NOT safe by ibraheemdev on Friday June 25, 2021 @12:26AM (#27627144)

Ah okay, so Devise does lookup the user in the database to authenticate. I guess it's not applicable to my premise then.

[ Parent | on HN ]