0

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am trying to solve

The first one is related to the validity of JWT. When the user logs in the application, the app generate a Refresh and an Access token in order to be used by the user. As per the JWT documentation, you can encode the expiration date inside the token, so you can know whenever the token is valid or not.

But what if you want to invalidate a list of JWTs? In case you want to invalidate all JWTs then you can update your secret if I understand correctly.

1
  • To invalidate JWT on the server-side, you have to store them somewhere and check the storage in every single request before claims validations. Caches are a good place since you can sync the token's lifespan to the lifespan of the "key-value" in the cache.
    – Laiv
    Nov 14, 2018 at 16:01

1 Answer 1

2

The point of JWTs is that they can be verified in a decentralized manner, simply by checking the signature. A JWT is therefore irrevocable. This limitation is by design.

If you create some authentication service that contains a list of revoked tokens, any consumers of the JWT must first check that auth service. This removes any advantages of the decentralized approach.

You might as well store all data in that auth service and only give out session IDs. Any consumers can the look up that data from the auth service, or get an error if they were using an invalid session ID.

Note that revocation across a distributed system is a difficult problem in general. E.g. domain certificates can be revoked in theory, but a lot of client software fails to check revocation status (e.g. using OCSP). However, shorter certificate validity durations can offset some of that risk. The equivalent for you would be to change keys frequently and expire the tokens quickly.

1
  • Have the same impression! Thanks for your response! :)
    – pik4
    Nov 15, 2018 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.