Hacker News Reader

>Do you have users? Do those users need to log in? Well, you now have access tokens related to users.

Aren't those tokens supposed to be stored client side anyway? Aren't those tokens supposed to contain encoded information about the user that you decode server side? Why would you store the users token to begin with?

View on HN

That's a matter of opinion and implementation. Not everyone uses JWTs. What if you want to invalidate all logged-in tokens for a user? You either need to store a blacklist (that's a relation) or set extremely short expiry times.

i think he is discussing standard cookie session ids here, not access tokens. in many web applications, all the information you need is stored within that token and signed by a server-side secret.

Same thing. How do you invalidate a signed cookie?

Reply on news.ycombinator.com