How to solve the problem of performance overhead of each verification of stateless Token and how to decrypt the hash algorithm of Token verification?

1 because the server does not save the login information of the user, stateless Token has to verify every visit, isn"t it very expensive to decrypt?
2 I have seen that stateless token can use hashing algorithm, but hashing algorithm is only an encrypted string after hashing, and it cannot be decrypted and restored to the original string, so how to verify it? The server does not keep the relevant information.

Oct.22,2021

generally, token is a hash algorithm, that is, a hash algorithm, which does not need to be decrypted, but only needs to check the signature, which is equivalent to making a signature. This overhead should be said to be acceptable.

A stateless token can carry information, such as a user's id, which is saved in plaintext .
Let's take the popular jwt as an example.

jwt although it is possible to set the validity period, for example, what if I want a user's corresponding token to expire? Do we have to wait until the expiration date?

Menu