gothinkster / gothinkster/node-express-realworld-example-app
[Security Issue] Invalidating tokens on logout
Open
- Dominant language
- TypeScript
- Stars
- 3.8k
- Forks
- 1.8k
- PR merge metrics
- No merged PRs in 30d
Description
The server doesn't have any way of invalidating a user's JWT once he/she has logged out. I was able to get the JWT from the request header, logout and still access protected APIs from [postman](https://www.getpostman.com/) using the old JWT.
* The above was done on the [deployed web app](https://vue-vuex-realworld.netlify.com/#/)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.