Hacker News Reader

Have a relatively short expiration time.

Or, if you want to have more immediate revokes without having a ridiculously short expiration time, keep a list of blacklisted tokens that you clear at least every <refresh time> seconds.

At the end of the day, JWTs still have to be accepted by the server, which you have complete control over.

View on HN

I can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or keep them in database which defeats the purpose of using JWT for sessions already, as I could do what I do now, just keep normal tokens in Redis and check them on every request.

Assuming blacklisting happens infrequently, you would have a few orders of magnitude fewer entries and could keep them in-memory on each server and have them fetch them all once every X seconds instead of for each request.

A lot of assumptions there to justify using JWT tokens. Unfortunately I can't allow someone that is blacklisted to use the service for X seconds.

Reply on news.ycombinator.com