Hacker News Reader

Why do you think you can't invalidate a JWT? Store a JWT that is associated with some object in a database that has the field `isInvalidated`. This isn't rocket science. Sure - this turns the JWT token into a session but there is no way to invalidate based on something that isn't determined at creation time without storing something in a database.

View on HN

What's the point of using a JWT if so? This effectively converts it into a session token

You can create a JWT without writing to a datastore - this is a key difference.

use a ttl on like a cache store, such as redis

Yes, but this is still a deadend.

How so?

It's effectively a micro-optimization that will have no real effect, but you can do a simple "exists" query when searching the revocation list, and the TTL keeps the collection small.

Not advocating for JWT as it's a silly mess to do everything correctly, but it is possible.

Searching a revocation list misses the point of RESTful authentication.

There is no such thing as a RESTful authentication. REST's design hinges on URIs being public.

What do public URIs have to do with it? I don't think we are speaking the same language.

Reply on news.ycombinator.com