search

szerhusenBC / jwt-spring-security-demo

A demo for using JWT (Json Web Token) with Spring Security and Spring Boot 2
MIT License
3.04k stars 1.33k forks source link

Token Invalidation #102

Closed Oluwaseun-Smart closed 5 years ago

Oluwaseun-Smart commented 5 years ago

Hi Stephan,

I will like to know if there's a way to invalidate a token when a user logout?

Once a user log out and the token has not expired yet, i want the token to be invalid token that will give an unauthorized error to any request by the user using the token again.

Thank you.

szerhusenBC commented 5 years ago

Hi @Oluwaseun-Smart ,

there are different approaches you could do that. Here's is a discussion from Stackoverflow:

https://stackoverflow.com/questions/21978658/invalidating-json-web-tokens

I hope, that helps you.

hamdimefteh commented 5 years ago

if you use angular Sir , you can simply delete the local token !

szerhusenBC commented 5 years ago

if you use angular Sir , you can simply delete the local token !

You're right. But the problem is, that you still could use the token (if you somehow copied it before etc.), because the app would say that it is valid. The question is how to invalidate it so you can't use it anymore after logout.

hamdimefteh commented 5 years ago

i made a token with 30min validation period : so no time ti use it again !

szerhusenBC commented 5 years ago

This may be a solution. But then you have to refresh it at least every 30 mins to keep it valid, right?