Why to not use JWT (2021)

Re:Why to not use JWT (2021) by hunterb123 on Thursday September 29, 2022 @10:19AM (#33020993)

I simply explained the efficiency difference of the two setups.

You're storing and checking a smaller subset when doing stateless + invalidation cache.

Whether or not you need that memory optimization is up to you and your machines.

Personally it's about the same effort to implement and I prefer stateless + simple redis cache for invalidations.

[ Parent | on HN ]

Re:Why to not use JWT (2021) by marcosdumay on Thursday September 29, 2022 @12:47PM (#33023377)

Well, on the other hand, you will have to distribute that revocation list somehow, what does add some complexity to your code.

If you are already distributing lists around your application servers (that impacts the format and top performance of the redis cache), then yes, it's quite simple.

[ Parent | on HN ]

Re:Why to not use JWT (2021) by hunterb123 on Thursday September 29, 2022 @06:57PM (#33028460)

Redis is pretty easy to distribute out of the box.

And most likely you'll want a simple k/v distributed cache for other things so it's no extra work.

[ Parent | on HN ]

Re:Why to not use JWT (2021) by dontlaugh on Monday October 03, 2022 @06:05AM (#33065447)

But then you can just put your session data in Redis. You're eating the latency to Redis either way.

[ Parent | on HN ]