How can logout using spring boot jwt

Question

I am using this example https://dzone.com/articles/spring-boot-security-json-web-tokenjwt-hello-world for creating spring boot rest api with json web token (JWT). but i am not found any api for forcefully logout using io.jsonwebtoken maven dependency .

i am using this dependency in pom :


groupId io.jsonwebtoken
artifactId jjwt
version 0.9.1

can any one tell me about this dependency, provide any logout or revoke token api or not . if not, provide any solution for forcefully logout using this process.

In this example, we will be making use of hard-coded user values for user authentication. Normally, there is no logout for token mechanism, since server never create session... What you can do is remove (you need to store it somewhere and check if it exists...) / deny token by some criteria. In this article, follow instruction of Spring Boot + JWT + MYSQL JPA for storing and fetching user credentials. — Valijon
Thanks @Valijon for reply , i just want to invalidate token on logout using jwt. because it not mantain session on server side. so how can we resolve force logout from jwt without saving token in db, because if i follow to save token in db and set token blacklist. and after then we check token is blacklist or not on every server request. i think this is not a right way for logout and check in all request for token blacklist. can you tell me any other process or any other approach to logout in spring boot rest full api — Rakesh Kumar
Logout means close the session, but with JWT and other token mechanism, there is no session... There is no any solution for your requirements. Use standard security mechanism related with session, so then you can logout... — Valijon
you mean JWT not provide any thing for revoke token? if this is true can you tell me , any other process for spring boot rest api authentication for our app mobile users. — Rakesh Kumar
@RakeshKumar I have the same problem, how you found a solution for that? — MJBZA

Dmitrii Cheremisin Dmitrii Cheremisin · Accepted Answer · 2020-04-28T09:25:01

There can be done several things for logout:

Usually, jwt tokens are stored in browser local storage or session storage if we talk about single page applications. So, the first thing that can be done in this case - remove token from storage:

window.sessionStorage.removeItem("token") // for session storage

or

window.localstorage.removeItem("token") // for local storage

Ref about them: https://developer.mozilla.org/ru/docs/Web/API/Window/sessionStorage https://developer.mozilla.org/ru/docs/Web/API/Window/localStorage

My example in angular: https://github.com/dmcheremisin/TodoApp/blob/master/frontend/src/app/service/jwt-authentication.service.ts

But the client may store this token somewhere and provide manually. To avoid long time usage of token you should set short expiration time. For example, 15 minutes.

If you need to allow further usage of token - you refresh it, otherwise reject.

Example refresh method:

public String refreshToken(String token) {
    final Date createdDate = new Date();
    final Date expirationDate = calculateExpirationDate(createdDate);

    final Claims claims = getAllClaimsFromToken(token);
    claims.setIssuedAt(createdDate);
    claims.setExpiration(expirationDate);

    return Jwts.builder().setClaims(claims).signWith(SignatureAlgorithm.HS512, secret).compact();
}

This code snippet is from my repo that uses the same library jjwt: https://github.com/dmcheremisin/TodoApp/blob/master/backend/src/main/java/com/todo/app/util/JwtTokenUtil.java

Blacklist logged out tokens. I personally don't like this approach, beacuse you need centralized place for blacklisted tokens in case of multi-node application. JWT tokens were created for avoiding linking to the session of concrete web server(node) session. So, you can't store tokens in only one node of your application.

Related article: https://medium.com/devgorilla/how-to-log-out-when-using-jwt-a8c7823e8a6

How can logout using spring boot jwt

2 Answers