|
|
|
|
|
|
by jappgar
41 days ago
|
|
|
Most requests are reads and letting someone use an invalidated session for reads for 30 seconds on a shortlived token isn't the end of the world, especially considering that the exact invalidation timing and its propagation is already somewhat arbitrary. For rarer privileged actions you can check a token revocation list. |
|
|