3 ms·
JWTs can be revoked if you sign them with application_key + some_user_revocation_string. This is how password reset tokens work in Django, for example. They'r
by bjt 10y ago
JWTs can be revoked if you sign them with application_key + some_user_revocation_string.
This is how password reset tokens work in Django, for example. They're signed with the app's secret key + the user's existing password hash. Once the user uses the token to change the password, the token is no longer valid.
- Normal_gaussian 10y agoHowever every service now needs access to the list of hashed passwords.
- bjt 10y agoOr access to a service that has access to the hashes/revocation strings. Which puts you in a similar situation to non-JWT scenarios where every service has to phone home to check a token's validity. I'm not saying all tokens should be made revocable in this way. I'm saying that people claiming "you can't invalidate a JWT" are overstating their case. If you really need to do invalidation, this is one option.
- mwpmaybe 10y agoHrrm, now you're in a situation where you're using part of the unverified payload to look up part of the secret before validating the signature and hence the payload. This is a neat idea but it introduces a whole class of potential vulnerabilities. (This is similar to the argument against the algorithm being selected from the unverified payload before being used to validate the signature per the JWT specification.)