Logout JWT with nestJS

user_15095228 0
Viewed 7059

I'm using JWT passaport to login module:

 async validateUser(userEmail: string, userPassword: string) {
    const user = await this.userService.findByEmail(userEmail);
    if (user && user.password === userPassword) {
      const { id, name, email } = user;
      return { id: id, name, email };
    }else {
      throw new UnauthorizedException({
        error: 'Incorrect username or password'
      });
    }
  }

  async login(user: any) {
    const payload = { email: user.email, sub: user.id };
    return {
      access_token: this.jwtService.sign(payload),
    };
  }

This part is running. My question is: how do the logout? I read about creating a blacklist and adding the token to it, but how do I get the user's access token?

passport-jwt nestjs
7 Answers

Something you should know about token-based authentication is that it is stateless. This means that even the server does not keep track of which users are authenticated, like with session-based authentication. As such, you do not need to do anything on the server side to "log out" a user. You simply need to delete the t\JWT token on the client. If you make a request to the server app, without a valid JWT token, it will be treated as the user is not logged in.

user_95810620

Generally when a logout request would be sent the Authorization header should be present, so you can grab the token from there. Then you can save the token to the database's restrict list table.

user_95761860

When user click to "Log out" btn, you should sent a request which is attached Authorization header with bearer token. In the backend side, you need to extract header and push the token to the blacklist token (as your solution). Basically, you only need remove token in client side, it's so easy to do but in the worst case when the token was stolen by hacker, your token still valid. Using blacklist token is more secure but it can be lead to performance issue and scalable. What is the best solution? it's depend on you.

user_99703560

Read the Nestjs Execution context get the token from the request header and verify this token from JWT.

everything defines in the NESTJS link

//here we check the token from the header is valid or not expired

const tokenVarify = await this.jwtService.verify(token);
user_124164400

my idea is make whitelist every generate new token and remove it when user logout. so u need to check on guard also every user with token access its exist on whitelist or note

user_57053850
user_27131250

Actually there is a workaround for this, but not so straightforward! The idea is to keep track of the tokens for logged out users (use some sort of black-list) and query provided token against that black-list.

To sum it up, you can follow these 4 steps:

  1. Set a reasonable expiration time on tokens
  2. Delete the stored token from client side upon log out
  3. Have DB of no longer active tokens that still have some time to live
  4. Query provided token against The Blacklist on every authorized request

For detailed explanations, you can check this post: medium

A guide in how to do the implementation is in this youtube video Code with Vlad , and there's as well the github source nestjs-jwts. I followed this video and implemented myself as well..

user_15485960
Related