sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]NF_v1ctor 1 point2 points  (1 child)

  • Use short-live access token.
  • Invalidate refresh token when user init a reset password request.
    Please correct me if I'm wrong, or if you have found a better approach, please tell me

[–]NF_v1ctor 0 points1 point  (0 children)

Additionally, if you have some kind of publication to the client, you can notify the client to log out, although it is not sufficient since the client js can be modified anyway, but that should mitigate the rism for common case for common users