5 ms·
That was my point. You can easily add validation checks to JWT. Just invalidate tokens issued before a certain time.
by drikerf 4y ago
That was my point. You can easily add validation checks to JWT. Just invalidate tokens issued before a certain time.
- senko 4y agoHow do you do it without the service going into some sort of a database to check if there's a certain time for which all tokens older than it should be invalidated?
- ffo 4y agoWell you don't ;-) If you stick to OAuth and OIDC you have the option to validate the tokens against the userinfo and introspect endpoints, but that's, just another "database"