[Question] Server side implementation of signOut?

the-road-to-graphql / fullstack-apollo-express-mongodb-boilerplate

💥A sophisticated GraphQL with Apollo, Express and MongoDB boilerplate project.

https://www.robinwieruch.de

MIT License

337 stars 104 forks source link

[Question] Server side implementation of signOut? #8

Open aaayushsingh opened 5 years ago

aaayushsingh commented 5 years ago

I check out the react boilerplate and it appears signout is done by just deleting the token on client side. What happens if someone steals the token? Or the user wants to invalidate all of their sessions?

rwieruch commented 5 years ago

I think you would have to implement a refresh token mechanism here. I didn't want to go too much into detail here, because this application is also used in a tutorial of mine and I didn't want to scare newcomers away from it. But you are right, to avoid a security breach it would be wise to implement a refresh token mechanism.

rwieruch commented 5 years ago