BUG: Pressing logout does not invalidate token #9

New issue

Closed

opened 2020-12-31 06:27:55 +02:00 by hiimgoodpack · 1 comment

hiimgoodpack commented

2020-12-31 06:27:55 +02:00

Contributor

When you press logout, your token can still be used.

In the implementation of /browser/token/clear, the only thing that's done is remove the cookie for the token.

When you press logout, your token can still be used. In the implementation of /browser/token/clear, the only thing that's done is remove the cookie for the token.

hippoz commented

2020-12-31 11:12:14 +02:00

Owner

JWT tokens are very difficult to impossible to invalidate, due to the fact that they are only stored on the client. Issue will still remain open until I find a solution.