Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Implementing a logout-all-sessions function is not the behavior of an architecture astronaut--but building distributed auth because you footgunned yourself with microservices certainly is. And to implement that with JWT you aren't doing local validation because you can't do validation without implementing revocation and you've devolved back to checking a store for validity anyway.

That might not matter to you because you might not work on things that matter and that's fine. If what you work on doesn't matter, do whatever you want, but if it does, don't use JWT.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: