Hacker News Reader

Comment by mc4ndr3 | Hacker News Reader

False. OIDC providers expose an API endpoint for early token revocation. Otherwise it would be impossible for users to LOGOUT.

The insertion of tons of junk metadata in a JWT's claims represents a problem of usage style, not an inherent problem of JWT or OIDC. As a workaround for good data design, the user can be presented with a re-authentication form, where the new token shall replace the old data.

View on HN

Yep, and if you’re like “if you have to store a revocation/update list then isn’t that just a stateful session again?” Yes but now you only have to store the changed tokens instead of every token — good trick if you’re having trouble scaling Redis.

A logout may just consist of deleting the token in the browser.

In Nexus I store tokens in the database. Logging out deletes the record.

Isn’t that just sessions but with extra steps?

Well the JWT has encrypted info that is verified on each call, so there is extra security.

yeah, JWT's are a nice standard way of doing that, but it's functionally not really different than the HTTPS + Session + Nonce pattern that's been in use for about 10 years now, and, provided you pick a secure function to make the hash for the nonce, the nonce may be more secure since it rotates with each payload and the JWT's encryption lasts for its lifetime.

The JWTs I use expire after a given time and are renewed. I agree, there's not much difference. Its more like a standard way of generating tokens.

Reply on news.ycombinator.com