Aaron Parecki

This is the problem with most JWT based systems around logout and revocation. I find this to be an anti-pattern and a very common one. Security here is sacrificed at the altar of scalability and statelessness. #tears

If a user “logs out” and the JWT isn’t invalidated they can still perform actions. Most distributed apps don’t notify all micro services a JWT is no longer valid and the micro service just goes “okay”. And for performance, the micro service doesn’t verify validity.

Slack is just an all day meeting with no agenda

wish i was bitcoin so someone would hold me

wish I was a deadline so someone would miss me

OH on Discord: “Hey, what is the minimum USD amount for an OAuth transfer”

(which is a mind-blowing concept if you’ve been around the protocol as long as I have)

OH on Discord: “Hey, what is the minimum USD amount for an OAuth transfer”

(which is a mind-blowing concept if you’ve been around the protocol as long as I have)

You know you could have just implemented edit and deployed it in an afternoon back in 2007 and we’d all have it today. I blame @blaine for the lack of the edit button.