How should session revocation affect requests already in flight?

<p><strong>How do you handle session revocation while a request is still in flight?</strong></p> <p>I’m working on a Node.js and PostgreSQL web app and reviewing its access controls before moving a local prototype to Linux hosting. The requests involve sensitive form data.</p> <p>The case I’m trying to handle is:</p> <ol> <li>A user submits a save.</li> <li>Their access is revoked while the reques

Read the source →