0

I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful?

As far as I found the solution is you need a database that store token blacklist. Then now what is the different with stateful approach?

Improve this question
1
  • An invalid token doesn't invalidate the session, because there's no session (in server-side) to be invalidated. The client-side can keep the latest state of the app despite its token is no longer valid.
    – Laiv
    Jan 3, 2018 at 18:42

1 Answer 1

Reset to default
3

That's actually one of the caveats of completely stateless JWTs. You cannot invalidate specific token. You may invalidate them all by changing your secret on the server, however this operation will revoke all JWTs, not just a single one.

If you'd like to introduce blacklisting, you unfortunately have no other choice than to introduce some id into your token's payload and verify its state against some sort of database, as you've pointed out.

Improve this answer
7
  • then must I go with a full of stateful implementation, or hybrid like JWT + blacklisting?
    – Yosua Lijanto Binar
    Jan 3, 2018 at 10:20
  • @YosuaLijantoBinar Yes. If you'd like to use JWTs and be able to invalidate them, you will need to create a hybrid and your authentication will not be in-memory only but will check against the database, too. If you are also just starting to work on the authentication mechanism, for security reasons the Fernet token might be a better choice as a JWT replacement.
    – Andy
    Jan 3, 2018 at 10:24
  • Just a note. The blacklist doesn't need to be part of the OAuth2 server or part of the webservice. It only takes to be capable to write/read a plain text file. Something doable for any http server + plugins. It's infrastructure (like would be any firewall), not business. It can be also a off-the-shelve application. The thing is that it has nothing to do with JWT or OAuth2. That's why many of these things are features out-of-the-box in many API managers. These can be decoupled so your application remains stateless. It's Web architecture, take advantage of all its capabilities.
    – Laiv
    Jan 3, 2018 at 19:06
  • @Laiv I think it has same result when placing blacklist in other approach than in the OAuth2 server or part of the webservice. The thing is webservice need to always check blacklist first every request, so it remains stateful.
    – Yosua Lijanto Binar
    Jan 3, 2018 at 19:18
  • Take a look to any API manager. The blacklist is implemented totally out of the scope of the webservice. The webservice only needs a JWT in order to proceed. The blacklist doesn't necessarily belongs to the service/business. That's the point and the way to go in distributed applications.
    – Laiv
    Jan 3, 2018 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.