I'm looking to know if it's easy or not to port your sdk for python to rust

Out python SDK only handles session management at the moment. Not the entire login functionality.

I'll look other sdk yo know if it's possible to port quickly or not

Thanks

You can have a look at our node SDK. That has all the functionality

Ok thanks and have you an ETA for the availability of complete python sdk?

We are exploring an architecture solution that will enable us to more easily support more SDKs without much effort. If that falls through, then perhaps 1-2 months from now. Else it may take longer...

And when you say python, do you mean flask or django?

Hello, i didn't find any docs for the core api. I was looking into implementing the backend api myself as i'm not using any supported platform. Are docs for the core api available somewhere?

as a general question: how are jwts invalidated in supertokens?

i read your blog posts regarding session management and it mentioned invalidating both the refresh token as well as access tokens (jwt) when a user logs out

Hey @User the APIs exposed by the core are here: https://github.com/supertokens/core-driver-interface/blob/master/2.7.0.md As a reference on how to use them, you can have a look at our node js SDK and docs (https://supertokens.io/docs/nodejs/installation)

ah cool

thanks

> as a general question: how are jwts invalidated in supertokens? We have access token blacklisting as a feature. Essentially, when this is switched on, we extract the session ID from the access token (JWT), and check if that ID is in the db or not. If the session is removed, that ID will not be in the db.

but doesn't this mean that the blacklist is checked on each api request?

yes. That's the disadvantage of switching on blacklisting.

A better implementation will come eventually which uses a caching layer.

so if i wouldn't switch on blacklisting and i deleted a session only the refresh token will be deleted, correct?

yes.

ok i think i can live with that

you can implement blacklisting caching yourself by: - Switching off blacklisting from supertokens' side (which is the default) - Post session verification, check your cache for that session ID (we call this

sessionHandle

). If your cache (blacklist) as this, then disallow the API call by returning a 401. - When calling sign out, or revoking the session some other way, add the session handle to your blacklist

yeah, makes sense

If you do not switch on blacklisting, and don't implement it by yourself, we recommend keeping the access token's lifetime as short as you possible. To change it, see: https://supertokens.io/docs/session/common-customizations/sessions/change-session-timeout

yup

ok thanks!

@rp thank you but it's not good for me, excepted session because we're full python and maybe rust, nothing about nodejs for the backend

is there any vue/nuxtjs samples around ?

Hey @User we don’t support vue for login yet, but we do support it for sessions.

thanks 🙂