{"action":"created","issue":{"url":"https://api.github.com/repos/scolby33/wheres_charlie/issues/6","repository_url":"https://api.github.com/repos/scolby33/wheres_charlie","labels_url":"https://api.github.com/repos/scolby33/wheres_charlie/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/scolby33/wheres_charlie/issues/6/comments","events_url":"https://api.github.com/repos/scolby33/wheres_charlie/issues/6/events","html_url":"https://github.com/scolby33/wheres_charlie/issues/6","id":132262761,"number":6,"title":"Dealing with token revocation.","user":{"login":"scolby33","id":9711846,"avatar_url":"https://avatars.githubusercontent.com/u/9711846?v=3","gravatar_id":"","url":"https://api.github.com/users/scolby33","html_url":"https://github.com/scolby33","followers_url":"https://api.github.com/users/scolby33/followers","following_url":"https://api.github.com/users/scolby33/following{/other_user}","gists_url":"https://api.github.com/users/scolby33/gists{/gist_id}","starred_url":"https://api.github.com/users/scolby33/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scolby33/subscriptions","organizations_url":"https://api.github.com/users/scolby33/orgs","repos_url":"https://api.github.com/users/scolby33/repos","events_url":"https://api.github.com/users/scolby33/events{/privacy}","received_events_url":"https://api.github.com/users/scolby33/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-08T21:35:42Z","updated_at":"2016-02-08T23:47:44Z","closed_at":null,"body":"When acquiring an authentication token, it is issued with a short expiration time. I intend to implement a method to obtain longer-lasting credentials (several months or a year?) for use in dumb automated systems (IFTTT, in particular) that can't deal with authenticating or renewing tokens. This raises the question of what to do with long-lasting tokens (or any tokens) that escape and need to be revoked.\r\n\r\nThe token implementation we're using (JWT) does not require storing state on the server--all the required authentication information is stored in the token and cryptographically signed. That means when a token is revoked based on its unique identifier, the server has no way to know how long the validity period of the revoked token is. This would require storing the token revocation state indefinitely, which seems wrong to me.\r\n\r\nPerhaps we place an upper limit on the length of time that a token can be valid for (a year?) and store revocation information for one year from the revocation date? Comments are welcome."},"comment":{"url":"https://api.github.com/repos/scolby33/wheres_charlie/issues/comments/181627898","html_url":"https://github.com/scolby33/wheres_charlie/issues/6#issuecomment-181627898","issue_url":"https://api.github.com/repos/scolby33/wheres_charlie/issues/6","id":181627898,"user":{"login":"cthoyt","id":5069736,"avatar_url":"https://avatars.githubusercontent.com/u/5069736?v=3","gravatar_id":"","url":"https://api.github.com/users/cthoyt","html_url":"https://github.com/cthoyt","followers_url":"https://api.github.com/users/cthoyt/followers","following_url":"https://api.github.com/users/cthoyt/following{/other_user}","gists_url":"https://api.github.com/users/cthoyt/gists{/gist_id}","starred_url":"https://api.github.com/users/cthoyt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cthoyt/subscriptions","organizations_url":"https://api.github.com/users/cthoyt/orgs","repos_url":"https://api.github.com/users/cthoyt/repos","events_url":"https://api.github.com/users/cthoyt/events{/privacy}","received_events_url":"https://api.github.com/users/cthoyt/received_events","type":"User","site_admin":false},"created_at":"2016-02-08T23:47:44Z","updated_at":"2016-02-08T23:47:44Z","body":"I think the solution is to build a wall"}}