Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

9
  • 5
    OAuth and JWT are different things. Commented Nov 9, 2022 at 0:00
  • @ThoriumBR good point. Are they compatible? Have I conflated things that I shouldn't have? Commented Nov 9, 2022 at 0:12
  • 6
    JWT is stateless, OAuth is stateful. JWT is self-contained, OAuth needs a backend. Revoking JWT is complex and not always possible, OAuth is trivial. JWT are faster to validate (no database access needed), OAuth requires a database. Commented Nov 9, 2022 at 0:16
  • 2
    You could have a database of revoked tokens, that would be significantly smaller than a database of valid tokens. Commented Nov 9, 2022 at 19:50
  • Size isn't typically the problem for the state -- it's creating a single point of failure/overhead for your auth Commented Nov 10, 2022 at 21:45