Skip to content

Stateful JWTs: Addressing issue #2 - #4

Open
MapManagement wants to merge 2 commits into
mainfrom
stateful-jwt
Open

Stateful JWTs: Addressing issue #2#4
MapManagement wants to merge 2 commits into
mainfrom
stateful-jwt

Conversation

@MapManagement

Copy link
Copy Markdown
Owner

The motivation has already been explained in issue #2. I'm making JWTs stateful by adding a version claim and storing the most recent one alongside the user in the database. This allows the backend to check if a token is invalid and can't be used for authentication. The new flow looks like this:

  1. User logs in by entering username and password as before
  2. If the credentials are valid, the stored JWT version of the user increases by 1, the generated JWT contains the following claims
    • sub: user ID
    • name: username
    • JTI: JWT version at that time
  3. Only the latest JWT can be used for further authentication and authorization, requests with older JWTs are denied
  4. Once the JWT expires or the user logs in again, the JWT version increases by 1 again and a new JWT is generated

@MapManagement MapManagement self-assigned this Jun 9, 2025
@MapManagement MapManagement added the enhancement New feature or request label Jun 9, 2025
@MapManagement

Copy link
Copy Markdown
Owner Author

yoyoyoyo @Plebysnacc, I guess there's not that much that has changed for you. It's just about the general auth flow and the JWT claims that you can now access.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant