CODEWITHSUNDEEP
javaauthenticationjwt
Arian
Arian

Reputation: 7719

Logout in token-based authentication and Single page application

I'm using JWT authentication for my Spring Boot application. The front-end is going to be a single-page-application.

Should I handle logout functionality on the server side? As far as I understand, there's no way to invalidate a JWT token unless we have a stateful server (storing logged out tokens for the maximum lifetime of a token).

The SPA passes the JWT token every time making a request in its header, and it can delete it from the localStorage when the user visits /logout without making a call to the server.

What are the potential issues? Is this idea used anywhere else? What is the best practice?

Upvotes: 2

Views: 1884

Answers (1)

waXve
waXve

Reputation: 862

First of all you must decide wether you want a statefull server, or not.

statefull server

this is easy. Just send a logout request to the server and throw the session away. That's it. That's the safest way.

stateless server

I like stateless servers because you don't have to manage the state. But of course you have a tradeoff. In this case the securety. There is no way to logout because you don't have a session that you can invalidate on the server side.

So an attacker which steels your JWT-token can use the session until it ends and there's nothing to do to prevent this.

But you can do something to avoid that the atacker can get the JWT Token. Here are some things that you can do and that you have done already right

  1. Don't use cookies to send the token. The way you do it is perfect. Use the header. This is encryptet by SSL and Single-page-app must send it on purpose.
  2. Put a timestamp into the JWT-Token so that it invalidates itselve after some time. But be aware of effects like Timezones and Clocks wich are out of sync.
  3. Put some browser fingerprinting information into the Token like the OS or the Browser version. In that way the atacker has also to fake that.

But these mechanisms are all there to make it harder for an atacker. A real logout is not possible.

Note

If you use JWT correctly your server will have a "state". You have to define a secret that is the same on all servers. That's something you must be aware of, if you use multiple servers.

Upvotes: 5

Related Questions