How does one define a revocation list?

biscuit-auth / biscuit-go

Apache License 2.0

75 stars 22 forks source link

How does one define a revocation list? #148

Open alecthomas opened 2 months ago

alecthomas commented 2 months ago

The only mention I can see of revocation is for retrieving, how do I revoke a token?

divarvel commented 3 weeks ago

the library does not offer helpers for these yet, so for now you are supposed to handle the revocation list yourself before running the authorizer.

Other libs like biscuit-haskell include this check during parsing to abort parsing as early as possible (you can revoke a token before verifying signatures and parsing block contents)