CODEWITHSUNDEEP
jwt
Romper
Romper

Reputation: 2257

JWT and blocking users

JWT is a stateless authentication mechanism as the user state is never saved in server memory.

How to invalidate the token if administrator blocks the user for some resons?

Upvotes: 6

Views: 3700

Answers (1)

Florian Winter
Florian Winter

Reputation: 5329

JWT is not an authentication mechanism but a token format. Since JWT are self-contained, you CAN use them for stateless authentication. However, this does not mean that your authentication mechanism MUST be stateless (although there it has its benefits).

There are several options for handling user lockout / revoking authorization:

  • Do a lookup of the user in every request after validating the JWT to see if the user is locked out
  • Access tokens are supposed to be short-lived, so you can look up the user the next time a new access token is requested (e.g., using a refresh token) and then refuse issuing a new access token
  • Alternatively, you can blacklist all tokens issued for a specific user by storing their jti in a database. See also: https://auth0.com/blog/denylist-json-web-token-api-keys/. EDIT: As pointed out in the comments, while not strictly stateless, this approach is still efficient, because a blacklist only needs to store blacklisted tokens for the duration of their lifetime, and lookup should be highly efficient.
  • You can look up the user identified by a specific JWT every N requests or whenever X percent of the lifetime of the JWT has passed rather than doing it in every request.

None of these approaches is entirely stateless. In general, stateless authorization is not possible if you want it to be possible to revoke authorization. If you want your tokens to be entirely stateless, you should make sure their lifetime is as short as possible, and issuing a new token is not stateless.

Upvotes: 3

Related Questions