JWT logout: Sharing blacklisted invalid token among services

Question

I am working on a microservices project involving 4 services - Auth Service, Service-A, Service-B and Service-C.

All the services are implemented using Spring Boot. The Auth Service is responsible for authenticating logged in user and generating a JWT bearer token. Each of Service-A/B/C has JWT filters which checks for validity of token and then provide access to the Rest APIs.

Now I want to implement logout feature. The logout request goes to Auth Service. The Auth Service uses Redis. The token is added to list of invalid tokens with ttl set so that after the expiry the token is removed automatically.

Now how can JWT filters in Service-A/B/C access the blacklisted token so that Rest API access is approved/disapproved? If all the services are deployed in same system the services can access Redis easily. If the services are deployed in different systems, how can they access the invalid tokens?

Should I implement pub/sub messaging and each service have a list of invalid tokens stored in redis? Or is there a better approach in microservices environment?

Answer 1

As already mentioned in the comments, one way to solve the whole problem is with the API Gateway. In it, the gateway checks for each request whether the JWT is included in the blocklist. If yes, the request will be rejected immediately with 401 or similar.

If a user logs out, the gateway adds the token to the blocklist and forwards the request to the auth service, if it wants to execute additional logic.

This way, service A, B and C can always be sure that when they receive a request, it is valid.

The blocklist should of course be selected so that it meets the requirements. If, for example, there are several gateway instances, a distributor storage must of course be selected, etc.

Answer 2

Edit: From the question I understood that blacklisting is only required to invalidate tokens on logout. In that scenario, the following solution allows you to achieve the result of sharing blacklisted tokens without actually using a blacklist.

One effective approach I have been using that does not require Redis or a list of invalid tokens utilises just a hash table:

• Store a table mapping each userId to lastLogout (a Date) on the auth server.
• Whenever login is called, it would query the auth server for the lastLogout, and only proceed with validating the JWT if it was issued after this date.
• Whenever logout is called, the auth server will update its table to set the lastLogout for that user to the current time and date.
• If a logged out user tries to log in to the same service or any other service with a token they used from before, that service will check the auth server for the lastLogout and reject the JWT if it should be considered expired (user has logged out since the creation of this token)

Note that this solution assumes all JWTs are created with iat (issued date).

This avoids consuming much space or processes to maintaining white or blacklists, relying on just a relatively light userId: string => lastLogout: date mapping.