search

WellDone / strato-old

Strato web portal - device management, configuration, and data visualization for MoMo mobile monitors
MIT License
2 stars 2 forks source link

Support server-side token invalidation? #90

Open amcgee opened 10 years ago

amcgee commented 10 years ago

Currently the only way to invalidate a JWT granting limited-lifetime access to certain resources is to rotate the HMAC signature secret, which will in fact invalidate all tokens. There should probably be a more fine-grained way of doing this, though since tokens are relatively short-lived (1 hour currently, we might want to decrease that) it's probably ok for now.

amcgee commented 10 years ago

Implementing this will require some level of server-side state (a collection of invalidated tokens) which is counter to the stateless nature of tokens to begin with.