Hacker News Reader

maybe you can add a `sid` in jwt token, then store this sid in redis. when you want invoke a session, just del this sid in redis.

View on HN

The author mentions that "One popular solution is to store a list of “revoked tokens” in a database and check it for every call. And if the token is part of that revoked list, then block the user from taking the next action. But then now you are making that extra call to the DB to check if the token is revoked and so deceives the purpose of JWT altogether."

I believe the author is 'assuming' the devs are not using a db to validate revoked sessions.

It doesn't have to be a DB tho it could be a server in-memory list that gets updated via pubsub or some other means. This is a hell of a lot faster than doing a network call to a DB and because revocation lists should be small by definition and only exist for the length of the token expiration they are limited in their space requirement

Reply on news.ycombinator.com