alt Hacker NewsRevocation lists can simply be replaced with a "tokens not valid before" field per user. When a user logs out, set the field to now(). Reject JWTs that have an iat less than that value. Am I missing something?
Replies
dchest • yesterday at 10:13 PM
Yeah, you made a revocation list but with time value instead of the token value.
What you're missing is that you're still creating state. You're still having to check a database to determine what the "tokens not valid before" value is for that user.
And what if the user is logged in from multiple devices, but only wants to log out from ONE of them? Your solution logs them out from all of them.
The entire point is that it is not possible to have authentication that is both: 1. stateless. 2. secure.
And so if authN is going to be stateful anyways, you might as well just use an opaque token in a database and eliminate all the complexities and foot-guns of JWTs.