Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A "logout" action from the user should just delete the JWT from the device he is using. Asuming the token wasn't compromised, there is no backend work involved.

Is this as secure as doing a blacklist for non-expired tokens? No, it isn't. It is a sane tradeoff between decent security and implementation complexity.



  > A "logout" action from the user should just delete the JWT from the device he is using.
I wouldn't say should. It may. If you're fine with inability to terminate sessions on other devices.


Terminating sessions on other devices is not possible, but another tradeoff is using a "Logout from all devices" mechanism. In that case you just have a global "token not issue before" field, and when you logout from all devices, set that timestamp to the current time (and all issued tokens will fail authentication). But again, tradeoff. You individual requirements may vary.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: