Update/change roles claim (or any other claim) in JWT

user_1320551 0
Viewed 13267

I'm storing user roles inside a JWT (to restrict API endpoints). The roles can be changed by an administrator.

If a role is changed. How am I supposed to reflect this inside all tokens? I've thought about a couple of solutions:

  • If I'd use refresh tokens, the user would have to wait until the expiration date of the access token is expired.

  • I could keep a record of changed user IDs and check every request, and then return a new token if the user has been changed.

Is there a standard way to do this?

jwt asp.net-core asp.net-core-webapi oauth authentication
5 Answers

To address that scenario, you can keep the token lifetime short, once the token expires you can renew the token silently in case of Implicit grant or use refresh token mechanism to issue a new token from the authorization server. Once the role has changed, it might not reflect in the token instantly, but it will be available once the token is renewed.

user_76553550

@Janar said three solutions to handle different scenarios, but they still exist corresponding drawbacks.

I also have a idea to revoke your token:

  1. set iat to JWT payload. (You should know what is the iat)
  2. revoke tokens of a user:
    • find the user id
    • let auth server rejects tokens which are before current time(judged by iat) and belong to this user(judged by userId)
user_55892920

A solution to this would be to keep authentication and authorization separate when using JWT tokens. Use the token for authentication(claiming an ID) and use that ID to check the authorization in the database. This can increase the latency of each request considering that you now have to check the authorization for each request. However, this can be mitigated by using an in-memory data structure store(such as Redis) as a cache. On every permission change, delete the cache and make another call for the permissions.

user_162955580
Related