4 ms·
For invalidating, you just need to store the JTI (id, as a UUID) of the token in the DB. On challenge, you just compare the JTI of provided token to the one sto
by _asummers 8y ago
For invalidating, you just need to store the JTI (id, as a UUID) of the token in the DB. On challenge, you just compare the JTI of provided token to the one stored, and if there's a mismatch you 401. For doing the actual revokation, you can just clear the active JTI and have app code that would reject that. It's certainly arguable if this is worse or better than session tokens, but it's not unsolvable.
- CiPHPerCoder 8y agoIt's not unsolvable, just incompatible with the premise of "use JWT for sessions" which is to avoid the database hit entirely.
- deleted 8y ago[deleted]
- Dirlewanger 8y agoYup, I can't believe the author didn't go over something like this. It's the perfect use for the JTI. Put it as a column on your users table and all set. We use a Ruby authentication library that does exactly this.