DEV Community

Discussion on: Please Stop Using Local Storage

Collapse
 
togakangaroo profile image
George Mauer

you've got to manage a revocation list centrally

This might be true for Google or Amazon but is not actually true for the majority of applications out there I would argue.

You find out a token is compromised? Just regenerate your signing key. Yes every application user will have to log in again but that is a perfectly acceptable action for most applications.