Sessions & Cascade Revocation

Why Opaque Tokens?

Traditional JWTs leak claims into client memory and cannot be reliably revoked in real-time if a user chargebacks, shares credentials, or gets banned. NineAuth uses high-entropy opaque tokens:

• Client receives: A cryptographically random 256-bit hex token (tok_live_8f7b3...).
• Database stores: Only the deterministic SHA-256(token) digest. Even in the event of a database leak, active tokens cannot be reconstructed.
• Server verification: Every validation hashes the incoming token and checks status in PostgreSQL with sub-millisecond indexed lookup.

Instant Cascade Revocation

When a license expires, gets revoked, or a user changes passwords, NineAuth initiates a cascade revocation that invalidates all corresponding active sessions across all devices:

// Database mutation triggers atomic cascade invalidation:
// UPDATE sessions SET status = 'revoked', revoked_at = NOW() 
// WHERE user_id = $1 AND application_id = $2;

// Subsequent validation calls immediately return:
// HTTP 401 Unauthorized { "error": { "code": "SESSION_REVOKED" } }