JWT seems to be not secure solution for a REST API

Question

I am developing a REST API but JWT's looks wrong to me. We all calling them as "stateless tokens" but actually they brings a lot of problems.

We all say, they should not be stored in a database or memory cache solutions. But there are 3 core conditions about that API for me, please enlighten me about how can I implemented them without accessing / store them in DB.

When user changes his password, the token should be invalidated immediately.
When user log-out, the token should be invalidated immediately.
The architecture should be available to scale horizontally easily. I don't want a trouble.

If we do database/cache lookups in each request for those conditions, JWT is a totally useless solution, Isn't it?

user_5636865 · Answer

I don't believe JWTs allow for forced expiration like you are looking for. What you are looking to use is more of a reference token which can be found here https://identityserver4.readthedocs.io/en/latest/topics/reference_tokens.html?highlight=reference.

With that being said, JWTs still are still very useful. They are best implemented with very short expiration dates however.

JWT seems to be not secure solution for a REST API

1 Answers