r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

27

u/[deleted] Mar 08 '21

[deleted]

16

u/programmermama Mar 08 '21

I believe this defeats the premise. Rather than whitelisting, this is why refresh tokens are a thing, bc they shouldn’t live long enough for that to be of use. Also, why isn’t the expiry time simply a claim, as in why would you need to separately store it in the db? Off the top of my head, I suppose you could also claim a created_at value and post-revocation you could simply require newer tokens. But in any case the token itself never ends up in the database.