Both

I see. Alright! If there are more questions, please feel free to ask

my manger's manager is kind of genius

he's thinking if we can apply public/secret key method between web-frondend & web-backend

Doesn't having HTTPS already do that?

yes but in another aspect

for example, if my backend can decrypt the http message , this request is accepted

working like authorization

I see. So similar to what AWS gateway does?

I don't know, it does?

are you talking about Amazon API Gateway ?

yea. Their frontend SDK signs each request that is sent, and their gateway verifies that. This prevents replay attacks

yea

thank you for your information!

👍

@User How are you thinking about SuperTokens at the moment? Is there any info you are looking for that would help you evaluate it?

according to the documentation, I think it is useful for developers to quickly establish session management

but why not make superTokens as a API Gateway?

Becasue API gateways have many more things that they do. At the moment, we want to focus on sessions and do that extremely well. Maybe in the future, depending on our roadmap, it may become an API gateway.

I see

Hi @User , I'm wondering how SuperTokens handle logout/revoke issue if using JWT access token? Does SuperTokens use blacklist? Or just simply let token expire?

So when logging out, we clear the cookies on the frontend & revoke the session from the DB. In this case, if the JWT access token was previously saved manually by the user, they will still be able to access the APIs. That's why it's recommended to keep them as short lived as possible. We also have access token blacklisting, which will instantly revoke the JWT. However, there you loose the performance benefit of session verification.

so the blacklist stuff is like a option switch in SuperTokens?

yup

got it, thanks~

if your using on prem, then it's an option in the config.yaml file. If SaaS, it's a config on the dashboard -> edit configuration

if using docker, on prem, you can pass it as an env variable in your docker run command

One more thing, does SuperToken's access token made of JWS or JWE? it carries user's info, right?

We also plan on adding blacklisting check per API. So in your sensitive APIs, you can switch that on, whilst in GET requests, you can keep it off = good balance between security & speed

it's a JWS. It carries user info like their userID and anything else you want to give it