What is JWT revoke?
The most common way to revoke access to resources protected by a JWT involves setting its duration to a short period of time and revoking the refresh token so that the user can’t generate a new token. During the normal flow, the Todo API would accept the JWT until it expires, at which time access would be denied.
Can we revoke JWT token?
One way to revoke a JWT is by leveraging a distributed event system that notifies services when refresh tokens have been revoked. The identity provider broadcasts an event when a refresh token is revoked and other backends/services listen for the event.
What’s the best way to revoke a JWT?
The most common solution is to reduce the duration of the JWT and revoke the refresh token so that the user can’t generate a new JWT. With this setup, the JWT’s expiration duration is set to something short (5-10 minutes) and the refresh token is set to something long (2 weeks or 2 months).
How to expire already generated JWT token in Java?
By extending the Guards/Security Systems in your backend application with an additional DB join after performing the JWT comparison, you would be able to practically ‘revoke’ it by removing or soft-deleting it from the DB. I found one way of resolving the issue, How to expire already generated existing JWT token using Java?
How to revoke a user’s JWT in fusionauth?
We can now revoke a user’s refresh token and FusionAuth will broadcast the event to our Webhook. The Webhook then updates the JWTManager which will cause JWTs for that user to be revoked. This solution works well even in large systems with numerous backends.
What happens when a refresh token is revoked?
One way is leveraging a distributed event system that notifies services when refresh tokens have been revoked. The IdP broadcasts an event when a refresh token is revoked and other backends/services listen for the event.