JWTs and the Blacklist Problem
Convey's auth packages in two acts - a JWT layer that turns one config section into token issuing and validation, and the uncomfortable question every stateless system meets on logout day.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 388 articles
- 6 matching
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
jwt ×
Cards
List
JWTs, Refresh Tokens, and Revocation Without the Ceremony
The FastEndpoints.Security package covers the token lifecycle end to end - creation with symmetric or RSA keys, an abstract refresh-token service that is secretly an endpoint, and a revocation middleware that makes you pay the lookup tax honestly. Part 8 of FastEndpoints in Depth.
Identity in Fifteen Files
Pacco's Identity service fits its whole auth machinery - JWT issuance, a refresh-token aggregate, Redis deny-list revocation - in about fifteen files, and most of them are right. The three that aren't teach more - a mapper bug that leaves 202 callers polling forever, a dead password check, and a refresh token that never rotates.
Revoking the Irrevocable
DShop.Common makes a stateless JWT revocable with a Redis deny-list and a per-request round-trip - plus an iat claim in milliseconds and two validators that disagree.
Identity Done Mostly Right, Secrets Done Wrong
The Identity service gets the hard parts of auth genuinely right - issue, refresh, revoke - and then commits its signing key to source control and ships a CORS policy the spec forbids. Part 13 of Nine Services and a Message Bus.
The Security Inversion
DShop puts all its authorization at the gateway and none in the services behind it - then publishes every service port to the host. The compose file quietly defeats the entire security model.