DEV Community

Discussion on: How to invalidate a JWT using a blacklist

Collapse
 
bartosz_io profile image
Bartosz Pietrucha

Hi there! So you were maintaining a "small" list of invalidated tokens that still hadn't expired? If yes, did this approach include periodical scanning for expired tokens? Was this really advantageous compared to regular sessions with opaque tokens?