الانتهاء والتجديد والإلغاء

في هذا الدرس

compare sessions and tokens on lifetime and revocation.

الموضوعات المخطط لها

• Stateless tokens need no server storage, but cannot be taken back before they expire.
• So use short-lived access tokens (minutes) and, when needed, a refresh token to get new ones.
• A refresh token is long-lived, so store it carefully and make it revocable (kept server side) and rotate it on use.
• Sessions revoke instantly but need server state; tokens scale easily but revocation is harder.
• Logout on a stateless token usually means "forget it on the client" plus a short lifetime.