[icantevenhold]

Every authentication system i ever implemented (and I worked on many) needed some way to invalidate sessions regardless whether it’s self service for the user or not.

And once you do you need some state and then JWTs don’t make much sense anymore. There are of course many valid use cases for JWT so “JWT bad” is a very reductive take

[tasuki]

It's curious: very few authentication systems I ever implemented needed some way to invalidate sessions.

[tptacek]

You either reissue tokens constantly, every couple minutes or so, or you have to reliably invalidate.

[tasuki]

Maybe you do. Why would I have to do that?

[tptacek]

Because it's bad to ship products where a compromised token can never be recovered from. Revocation is the essential hard problem in authentication/authorization.

[tasuki]

I guess I just can't see the actual path here. How does a token get compromised in a way the victim finds out before the attacker makes ample use of the compromised token? From my pov, when the token gets compromised, you've lost already.

Note the auth systems I create usually do not process payment info and contain very little personal information (an email). I still think I'm fine without revocation mechanisms.