This is wrong design. HTTP is stateless so design a stateless system
You should implement a logout mechanism if you really need to log out. If not thatβs why we have token revalidation.
Either short expiry or logout
Redis shouldnβt be part of your auth. Itβs an overkill
When it's not okay is when the expiry time is long. If a token expires quickly (15-60 minutes), the risk window reduces.
My recommended solution for this would be a Token Blacklist/Denylist
How it works:
When a user logs out, store their JWT (or just the jti claim) in Redis.
Set the Redis entry to expire at the same time the JWT would naturally expire
On every authenticated request, check if the token is in the blacklist before accepting it
If blacklisted, reject the request even though the JWT signature is valid
Why this approach works ?
You're maintaining a list of "revoked but not yet expired" tokens. And also the check is fast (Redis lookup is fast)
Storage is temporary and automatically cleaned up when tokens expire naturally
There are other solutions to this issue, what else would you do?
@TosinOlugbenga Bro like what if you have to write a code for an Emulated device and no auth.
Simple one like a ussd gateway, let me see you use your auth library.
To the global community of tech gatekeepers triggered by this tweet.
You can use 3rd party auth services but basic authentication implementation shouldnβt be a big deal if youβre a software engineer.
Before this tweet will get to Iraq or Iran, make you all calm down.
Itβs not that deep.
If your are using nextJS it comes with a concept called a BFF. Itβs abstracts your api calls from your app itself and you can use whatever as your backend.
You can even plug a database directly as your backend
Hey guys
Building a website with Next.js for frontend.
Should I also use Next.js API routes / Server Actions as backend, or go with a separate backend (Node/Express or any other) ?
Looking for advice on scalability, clean architecture & future growth.