On: JSON Web Tokens vs. Sessions

[zbjornson]

How so?

It's effectively a micro-optimization that will have no real effect, but you can do a simple "exists" query when searching the revocation list, and the TTL keeps the collection small.

Not advocating for JWT as it's a silly mess to do everything correctly, but it is possible.

[jcoffland → zbjornson]

Searching a revocation list misses the point of RESTful authentication.

[zimbatm → jcoffland]

There is no such thing as a RESTful authentication. REST's design hinges on URIs being public.

[jcoffland → zimbatm]

What do public URIs have to do with it? I don't think we are speaking the same language.