How to revoke subscribers? about mercure HOT 1 CLOSED

Revocation will have to be handled at the JWT level. Every subscriber will have the "account-" target, to remove a subscriber from this account, you may:

• use a short expiration time for the JWT, so the subscriber will have to refresh it often, and when it will be removed, after the expiration time of the JWT you'll be sure that the subscriber access is revoked
• handle JWT revocation in a stateful auth mechanism that you'll put in front of the mercure hub: then you'll store in a persistence layer the list of revoked JWT, and prevent access if it is

wdyt?

from mercure.