Caching user sessions: JWT vs server-side sessions with Redis
Aleksei Lindberg
·531 views
we're using jwt for session management, which is great for statelessness, but we're hitting a wall with revocation. if a user logs out, or if we need to force-revoke a token (e.g., password change, security incident), the only real options are a short ttl (which isn't always ideal) or a server-side blacklist, which essentially defeats the statelessness benefit of jwt.
we're considering switching back to server-side sessions, probably backed by redis, to allow for clean, immediate revocation. is this a common pattern people are adopting to get the best of both worlds? or are there more elegant ways to handle jwt revocation at scale without a full session store? trying to balance security and operational simplicity.
0 comments