Hacker News Reader

Comment by lossolo | Hacker News Reader

The main and only argument against JWT tokens for me in context of user sessions is that I cannot revoke them if I block user account.

View on HN

Have a relatively short expiration time.

Or, if you want to have more immediate revokes without having a ridiculously short expiration time, keep a list of blacklisted tokens that you clear at least every <refresh time> seconds.

At the end of the day, JWTs still have to be accepted by the server, which you have complete control over.

I can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or keep them in database which defeats the purpose of using JWT for sessions already, as I could do what I do now, just keep normal tokens in Redis and check them on every request.

Assuming blacklisting happens infrequently, you would have a few orders of magnitude fewer entries and could keep them in-memory on each server and have them fetch them all once every X seconds instead of for each request.

A lot of assumptions there to justify using JWT tokens. Unfortunately I can't allow someone that is blacklisted to use the service for X seconds.

Well you can block them, it just means you lose advantages of a JWT, like not requiring a database hit.

This is the main issue, there is no point in using JWT tokens for me in context of sessions. I can just use standard solution and keep normal tokens in Redis if I need to make db call anyway.

Reply on news.ycombinator.com