Timeline for JWT logout: Sharing blacklisted invalid token among services
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 6, 2021 at 9:19 | history | edited | Bharath CS | CC BY-SA 4.0 |
added 546 characters in body
|
| Jul 6, 2021 at 9:15 | comment | added | Bharath CS |
Ah I see, my answer was proposing a solution that fulfils your use case without blacklisting. From the qn I thought you would ONLY blacklist tokens on logout. If that is correct, Service-A can GET /getLastLogoutOf?userId={...} to get the last logout time of user and use that to filter out JWT tokens that you would otherwise blacklist.
|
|
| Jul 6, 2021 at 8:58 | comment | added | user14132461 | blacklisting is not my core issue. How the all services get to know of the blacklisted tokens is the issue. As per your suggestion, when Service-A receives a GET request /getUsers with some token attached, the Service-A has to do a Rest api call to Service-A to check if the token is not blacklisted. If the token is valid then Service-A has to do rest of other verification and then proceed ahead to provide access to API | |
| Jul 6, 2021 at 8:47 | comment | added | Bharath CS |
The idea would be that on logout, the Auth server stores the current time as the lastLogout. Any service (A, B or C) can query getLastLogoutOf(userId) on the Auth server to compare the token's issue date and the last logout time. All tokens issued prior to the last logout are invalidated. Does this fulfil your blacklisting requirements?
|
|
| Jul 6, 2021 at 7:33 | comment | added | user14132461 | This does not exactly answer my question. How will Service-A/B/C validate the token when they receive requests? The Auth service has authenticated the user and responded back with token. Now client (Frontend) sends requests to any of the services with token. The services should check if the token is not among the blacklisted tokens, and verify other criterias and then allow access to apis | |
| Jul 6, 2021 at 6:50 | history | answered | Bharath CS | CC BY-SA 4.0 |