如何删除令牌 JWT

Question

I'm working on authentication on spring framework using JWT, bearer token.

public String generateToken(UserProfile authentication) {

  // set the expiration time        
  Date now = new Date();
  Date expiryDate = new Date(now.getTime() + jwtExpirationInMs);

  // Generate token and return      
  return Jwts.builder()
    .setSubject(authentication.getUsername())
    .claim("roles","user")
    .setIssuedAt(new Date())
    .setExpiration(expiryDate)
    .signWith(SignatureAlgorithm.HS512,jwtSecret)
    .compact();

The above class generates a token and respond back to the user. My question is how I'm going to delete the token when a user issue a new token before the first token expire time; to revoke the first token when a user request a new token before the first is expired?

Answer 1

I don't think that's possible to do with JWT. You could

• Add the old one to some fast storage (like Redis or memcached)
• Set some timeout on the value (a little big longer than the expire date of no longer wanted token)
• Check if the token from request exists in your cache, if yes then reject it

basically, do the blacklisting

I'm not aware of any other solutions

Answer 2

If you use JWT, you can't revoque the token. Its validity is embedded.

When you want to revoke a token, don't use JWT. You must persist the token and check its validity at every request.

If you really want to use it, save it in db as if it's not independent and add a flag or a timestamp for validity.

Check JWT documentation : https://jwt.io/