Hacker News Reader

If your using a salt, just change the salt and deploy. We frequently do this and it works great. All existing tokens are expired.

View on HN

So you invalidate all tokens? Or it is per user ID salt. If the latter where do you keep the salts and why not simply having a server side session ID, instead of the salt

Reply on news.ycombinator.com