Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thanks. Sounds like I need to do some more research on this. This isn't how I thought this was generally implemented by the big players, but I've not worked closely on auth either.

I guess for 2 and 3, you handle revocation by just deleting the relevant row or flagging a "revoked" column. For 1, add a unique id that you can add to a revocation list? Are there better/more typical ways to do this?



Revocation is a problem for encrypted tokens; it's a downside to the approach. The common solutions aren't particularly elegant.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: