News for hackers. Stuff that matters.
Re:Anatomy of a JWT by e12e on Wednesday March 02, 2022 @02:20PM (#30531587)
Yes, but also no. Typically you might need a valid jwt on every request, but a refresh token request on a different (hot) path only every 5 minutes per user. And revalidation might easily query a whitelist (sql/db - is user valid for login/refresh) or a blacklist (is refresh token invalid?).

The jwt being valid 10 minutes (accounting for clock drift) might be a problem - but probably sufficient for many applications?

There are no comments on this comment yet.