JWT is stateless. Then how do you logout users?

Question

Accepted Answer

Because JWTs are stateless—once issued, they remain valid until they expire—logging out a user is not a built-in feature. There is no automatic way to invalidate a JWT on the server when a user clicks "logout". Therefore, logout must be implemented by introducing some state that the server can check. This involves storing a record of invalidated tokens or rotating a user's key to deactivate old tokens. When a user logs out, their JWT (specifically its unique identifier, `jti`) is added to a blacklist (e.g., in Redis). The server then checks this list on every authenticated request. If the token is blacklisted, access is denied. This approach allows instant revocation, but it adds a database check per request, compromising statelessness. ```javascript
const redis = require('redis');
const client = redis.createClient();

// Logout: Add token's jti to Redis with expiry matching the token's TTL
app.post('/logout', (req, res) => {
  const token = req.headers.authorization.split(' ')[1];
  const decoded = jwt.decode(token);
  client.setex(`blacklist:${decoded.jti}`, decoded.exp, 'true');
  res.status(200).json({ message: 'Logged out successfully' });
});

// Authentication middleware
const authMiddleware = async (req, res, next) => {
  const token = req.headers.authorization.split(' ')[1];
  const decoded = jwt.decode(token);
  const isBlacklisted = await client.get(`blacklist:${decoded.jti}`);
  if (isBlacklisted) return res.status(401).json({ message: 'Token revoked' });
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
};
``` A "version" number (or timestamp) is stored in the user's record (in-memory cache or database). This version is embedded into the JWT payload during token issuance. On logout, the version number is incremented. For subsequent requests, the server compares the JWT's version with the current stored version; a mismatch invalidates the token. This avoids storing each individual token, but still requires a quick lookup per request. ```javascript
const NodeCache = require('node-cache');
const sessionCache = new NodeCache();

// Login: generate JWT with current session version
const login = (user) => {
  const sessionVersion = sessionCache.get(`user-${user.id}-version`) || 1;
  const token = jwt.sign({ userId: user.id, sessionVersion }, 'secret', { expiresIn: '1h' });
  return token;
};

// Logout: increment user's session version
const logout = (userId) => {
  const newVersion = (sessionCache.get(`user-${userId}-version`) || 1) + 1;
  sessionCache.set(`user-${userId}-version`, newVersion);
};

// Auth guard: validate session version from token
const authGuard = (req, res, next) => {
  const token = req.headers.authorization.split(' ')[1];
  const decoded = jwt.decode(token);
  const currentVersion = sessionCache.get(`user-${decoded.userId}-version`);
  if (!currentVersion || decoded.sessionVersion !== currentVersion) {
    return res.status(401).json({ message: 'Session invalidated' });
  }
  next();
};
``` In this pattern, the access token (short-lived, e.g., 15 minutes) is validated statelessly, while the refresh token (longer-lived) is stored on the server. On logout, the server simply deletes or revokes the refresh token. The access token is allowed to expire naturally. This is the most common approach, balancing security and performance. ```javascript
// Store refresh tokens in DB linked to user
const refreshTokens = new Map(); // In production, use a database table

// Login
app.post('/login', (req, res) => {
  const user = { id: 1, name: 'Alice' };
  const accessToken = jwt.sign({ userId: user.id }, 'access_secret', { expiresIn: '15m' });
  const refreshToken = jwt.sign({ userId: user.id }, 'refresh_secret', { expiresIn: '7d' });
  refreshTokens.set(refreshToken, user.id); // Store valid refresh token
  res.json({ accessToken, refreshToken });
});

// Logout: delete refresh token from server
app.post('/logout', (req, res) => {
  const { refreshToken } = req.body;
  refreshTokens.delete(refreshToken); // Revoke refresh token
  res.json({ message: 'Logged out' });
});

// Refresh endpoint checks if refresh token is still valid
app.post('/refresh', (req, res) => {
  const { refreshToken } = req.body;
  if (!refreshTokens.has(refreshToken)) return res.status(403).json({ message: 'Invalid refresh token' });
  const decoded = jwt.verify(refreshToken, 'refresh_secret');
  const newAccessToken = jwt.sign({ userId: decoded.userId }, 'access_secret', { expiresIn: '15m' });
  res.json({ accessToken: newAccessToken });
});
```

JWT is stateless. Then how do you logout users?

JWT logout relies on establishing control over token revocation through blacklisting, versioning, or refresh token invalidation, each with its own trade-offs in complexity and security.

JWT is stateless. Then how do you logout users?

JWT logout relies on establishing control over token revocation through blacklisting, versioning, or refresh token invalidation, each with its own trade-offs in complexity and security.

Scenario Questions

Follow-up Questions