5 ms·
The author mentions that "One popular solution is to store a list of “revoked tokens” in a database and check it for every call. And if the token is part of tha
by jopython 5y ago
The author mentions that "One popular solution is to store a list of “revoked tokens” in a database and check it for every call. And if the token is part of that revoked list, then block the user from taking the next action. But then now you are making that extra call to the DB to check if the token is revoked and so deceives the purpose of JWT altogether."
I believe the author is 'assuming' the devs are not using a db to validate revoked sessions.
- cphoover 5y agoIt doesn't have to be a DB tho it could be a server in-memory list that gets updated via pubsub or some other means. This is a hell of a lot faster than doing a network call to a DB and because revocation lists should be small by definition and only exist for the length of the token expiration they are limited in their space requirement