Hacker News new | ask | show | jobs
by oxymoron 3073 days ago
Well, you don’t, so if that’s a requirement you’ve got to do it some other way.
1 comments

You can rotate the secret to invalidate all tokens.
No, you can't. That breaks all of your users, and so you'll rarely do it, even when it might be warranted. Don't engineer security countermeasures that you (a) might need to rely on and (b) will be afraid to use.
Good points. But for some types of apps, you might have groups of users (a company, team, municipality) that you might be able to afford the cost of "everyone log in again". Or you might be able to safely log out everyone after business hours (if in the same timezone).