How to invalidate a JWT token PHP

Question

I'm trying to invalidate (or remove) a token from JWT but I can't achieve that. First I did something like this answer says Logout issue with Laravel JWT-auth authentication:

JWTAuth::invalidate(JWTAuth::getToken())):

But I get this error:

Non-static method Tymon\JWTAuth\JWT::invalidate() should not be called statically, assuming $this from incompatible context

Then I did something like this:

use Illuminate\Http\Request;
use Tymon\JWTAuth\JWTAuth;

class AuthController extends Controller
{
    protected $jwt;

    public function __construct(JWTAuth $jwt)
    {
        $this->jwt = $jwt;
    }

    public function invalidateToken(Request $request)
    {
        $this->jwt->parseToken()->invalidate();

        return response()->json(array('message' => 'log out'));
    }

    ...
}

But I can still use the token for another request and I can't remove or invalidate it.

What am I doing wrong to invalidate the token?

Edit:

I read another questions from here and issues post from the repo of JWT on github (this is the library I'm using) and I followed all the examples to invalidate or remove the token and I can't still remove or invalidate it .

By it's nature you can not invalidate token. Here your options: stackoverflow.com/questions/21978658/… — E_p
@E_p I'm using this library: github.com/tymondesigns/jwt-auth, I'm not using the library for nodejs — pableiros
Makes no difference JWT works same for any server side language. There is no mechanism to expire token An accepted answer in link I provided tells you how to deal with it. — E_p
The is an interesting POV about JWT revocation: dinochiesa.net/?p=1388 — Florent Morselli

NiCk.JaY NiCk.JaY · Accepted Answer · 2018-06-28T09:21:41

The blacklist feature works if cache_driver in your .env file is set to something other than array.

Changing it to file worked for me. However, in my particular case, I was using Entrust too, which causes issues when cache_driver is set to file or database. So, had to drop the blacklist/invalidate functionality.

Hope this helps someone.

How to invalidate a JWT token PHP

3 Answers