4 posts tagged "sessions".
Multi-App SSO pattern on Me2eM: one instance, many applications, zero user tables. Per-app personas, attestation chains instead of IdP, HttpOnly sessions and ban without a database — rooted in identity.
The server side of the protocol: NestJS Guard for verifyAttested, minimal state inventory — public roots, revocations, admin mapping — error routing and horizontal scaling without sticky sessions.
How to revoke signed tokens when there are no server sessions: granularity of revocation, fail-open vs fail-closed, record TTLs and why stateless ≠ irrevocable.
How a signed token replaces a server session: what's inside, what the verifier checks, how stateless differs from JWT — and why jti rotation makes revocation pinpoint.
Install a package, follow the quick start, and verify your first stateless session in minutes.