You're right, but the parent probably meant accessing the DB for every request for stuff other than revocation.
Re:Biscuit Authorization
by marcus_holmes on Thursday December 14, 2023 @03:45AM
(#38639217)
I did. Thanks :)
Assuming they don't manage to consolidate everything they need for a request into 1 query, one less query is still one less query. They might be cutting their db load in ~half if they had one auth query and one query for the action.
JWTs are really nice because you can validate things like roles and permissions just by validating the token signature. And there are much better ways to implement revocation lists than "calling the database on every API endpoint" (if that's what you were referring to). Since revocation lists are usually very small (depending on the nature of your app), it's often possible to just replicate them to in-memory data structures on your servers.