rp2684

6 ms·

1. 1.▲
   by rp2684 7y ago

   In this case, you would have to use rotating refresh tokens ( https://tools.ietf.org/html/rfc6819#section-5.2.2.3 ). They are essentially one-time use refresh tokens and help in token theft detection. So essentially, bot
2. 2.▲
   by rp2684 7y ago

   This problem will also exist if an opaque token is used instead of a JWT (as long as a refresh token is being used). Now you may argue that we don't need to use refresh tokens because that's complex, however, in that case, you are
3. 3.▲
   by rp2684 7y ago

   A way to solve this issue would be to synchronise around refresh API calls. This way, parallel refresh calls will never happen, and in fact, you need to even do the 2nd onwards refresh call. The trickiest part here is to also lock across ta
4. 4.▲
   by rp2684 7y ago

   One very important aspect of authentication is session management. Doing this wrong (or naively), can have catastrophic effects for your app!! Let me provide an example: It's common knowledge that JWTs are very common. A lot of people
5. 5.▲
   by rp2684 7y ago

   Cheers! Glad to help. If you want to discuss your idea specifically, you can DM me on reddit: @ilovefunctions
6. 6.▲
   by rp2684 8y ago

   I'm not sure what you mean by tools. But I go about structuring my ideas in the following way (at least for software related ideas.): First, I do secondary research about the idea. It's extremely rare that you have a completely un
7. 7.▲
   Making research papers easier for people to understand. What do you think?

   3 points by rp2684 8y ago|1 comments