Revoke/invalidate a token with JWT

Question

I'm using JWT (jsonwebtoken) package with node for token handling.

Is there any way to "logout"/revoke/invalidate a token?

Answer 1

If you just want to log the current user out, like @Massimiliano said, it's often implemented by deleting the token from whatever client-side store you've been using to keep track of it (eg. cookies).

If you need revocation for security reasons, here's an article that talks about why you might not want to go with JWT's in the first place, and instead use regular, opaque Bearer tokens (implemented by storing them in a database, often using a secure random string as their ID).

https://www.dinochiesa.net/?p=1388

Basically, they aren't revocable without adding a database lookup (negating one of the main reasons to use JWT's to begin with). And in the case of needing to revoke via a user interface, you're going to want to be able to query for tokens by user_id or group_id or similar, so you'll want to be able to index tokens by that information, instead of having it be opaque in the JWT claims.