[FR] Support revocation date #205
Description
Having a revokedAt field would allows to cheaply invalidate existing JWT tokens.
Steps to reproduce
- Have your session cookies compromised, Like LTT recently did
- Change your password < 6598 /ol>
Expected behavior
Attacker should not be able to log in.
Actual behavior
JWT cookie will still be valid. So would the socketio reconnection key. Allowing the attacker to login to your account, despite having changed your password.
Context
I use SAML where cascading logouts are a core feature. You should be able to logout once, and have all your SAML apps be disconnected remotely.