What is the difference between a blacklist of JWT's and sessions?

user_3110658 0
Viewed 151

Implementing a login flow and have been persuaded by JWT's because we have scaling as priority. In the past, the system would be based on session tokens in a monolith application. JWT's mean we don't need to have a caching server for user sessions anymore apparently. So then here's where I am confused:

If I get round the issue of revocation and token stealing by keeping a blacklist of keys (is the suggestion) then that now looks from above exactly the same thing as session tokens, because I'm doing a lookup with every request.

Perhaps I am not fully appreciating something or thinking of this wrong. Perhaps - the result of not finding the blocked JWT is faster than a full retrieval.

Thanks for anything that would clear this up :)

jwt authorization authentication
1 Answers

If you implement a feature where you keep a blacklist of tokens then indeed this does not change much from a session. You still need to lookup the token, keep the blacklist updated, properly replicated, etc.

What might work better is to have access tokens with a very short expiration time, like 5 or 15 minutes. A time short enough that you can accept the risk of someone stealing the token and using it for this short time. Then you can only keep a blacklist of refresh tokens, which are used less often.

user_17122940
Related