Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What about revokable JWT tokens? Isn't that similar to the random token approach, except each token holds some additional meaning, and revokable.


Yes. Revocation is painful with all of the stateless approaches; it's not on its own a reason to avoid JWT. On the other hand, the folkloric draw of JWT is that it's stateless, and they're only stateless if you can revoke them without issuing SQL queries.


A downside of stateful auth is the extra DB round trip on every request.

Different revocation techniques like periodically distributing a revocation list to your auth services can resolve that part of the issue.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: