Hacker News new | past | comments | ask | show | jobs | submit login

With ordinary sessions you need to store all active sessions in server. Sessions might be long-lived, may be eternal.

With JWT you need to store forcibly terminated active sessions in server. Those sessions are short-lived. So basically it's empty map.

Another solution with token is to change server key and force all short lived sessions to reauthenticate. It is not very nice, but if that's an extremely rare scenario, it might be appropriate to get rid of checking each request while still supporting forcible logout.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: