← Back to NxtKnit Catalog
🔥 Score 50.9
general • Confidence 40%

TokenRev: Real‑Time Session Revocation

Users are frustrated by the inability to revoke compromised JWTs, leading to persistent session hijacking risks. TokenRev replaces JWT with an opaque cookie and a backend‑for‑frontend token store, enabling instant revocation and reducing the attack surface.

Quantitative Score Breakdown

complaint frequency
3
growth rate
10
competition density
10.5
monetization potential
14.25
technical feasibility
7.5
search interest
5.6

Evidence Signal (2)

Raw Posts
hn • r/hackernews

Comment on: Stop using JSON Web Tokens for user sessions

The hacker doesn't need to know what the session ID is in order to be able to fully compromise an account and do whatever they want with it.The main drawback of JWT is that you can't reliably revoke a token after it has
hn • r/hackernews

Comment on: JWT is a scam and your app doesn't need it

Who uses JWT like this anyway?Typical production architecture would look like - frontend only ever sees an opaque session cookie - bff stores the access token against session and attaches it when calling backend servicesYes, storing JWTs directly in the frontend client is a bad idea but surely there is a better way of communicating that than "JWT is a scam and your app doesn't need it".> RS256 verification is in the same order of magnitude as a Redis lookupBut the point is that the verification is CPU bound and local to the service - which means that it is horizontally scalable.