How you can deal with making invalid a list of JWTs?

Question

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am trying to solve

The first one is related to the validity of JWT. When the user logs in the application, the app generate a Refresh and an Access token in order to be used by the user. As per the JWT documentation, you can encode the expiration date inside the token, so you can know whenever the token is valid or not.

But what if you want to invalidate a list of JWTs? In case you want to invalidate all JWTs then you can update your secret if I understand correctly.

Answer 1

The point of JWTs is that they can be verified in a decentralized manner, simply by checking the signature. A JWT is therefore irrevocable. This limitation is by design.

If you create some authentication service that contains a list of revoked tokens, any consumers of the JWT must first check that auth service. This removes any advantages of the decentralized approach.

You might as well store all data in that auth service and only give out session IDs. Any consumers can the look up that data from the auth service, or get an error if they were using an invalid session ID.

Note that revocation across a distributed system is a difficult problem in general. E.g. domain certificates can be revoked in theory, but a lot of client software fails to check revocation status (e.g. using OCSP). However, shorter certificate validity durations can offset some of that risk. The equivalent for you would be to change keys frequently and expire the tokens quickly.