User role changes from Admin to User. JWT still says Admin. What do you do?

Question

Accepted Answer

JWTs are stateless and cannot be modified after issuance. If a user's role changes, existing tokens still carry the old role claim. To enforce the new permissions, you must either wait for the token to expire or actively revoke it. The recommended approach is to issue short-lived access tokens (e.g., 5–15 minutes) combined with refresh tokens. When the role changes, you can revoke the user's refresh token(s), forcing the client to re-authenticate to obtain a new access token with the updated role. // Option A: Include role_version in JWT and check against database
const token = jwt.sign({ userId, role_version: user.roleVersion }, secret);
// Middleware: compare token.role_version with db.role_version
if (token.role_version !== user.roleVersion) return 401;

// Option B: Blacklist the specific token (store its jti)
const blacklist = new Set(); // Use Redis for distributed systems
function revokeToken(jti) { blacklist.add(jti); }
function isRevoked(jti) { return blacklist.has(jti); }
// On role change, revoke all tokens of that user (store user's token list)
``` Short-lived access tokens (5-15 min) + refresh token rotation: Revoke refresh token on role change, forcing new login or silent refresh. Token blacklist (Redis): Store revoked token IDs (jti) with TTL equal to remaining token lifetime. Check blacklist on each request. Role version column: Store a role_version integer in user DB; include it in JWT. On each request, compare with DB value; if mismatch, reject. Re‑fetch roles from DB on each request: Trade-off: adds DB call per request but allows instant role updates. Acceptable for low‑traffic services. Combined approach: Short-lived token + refresh token revocation is most common in production (OAuth2 pattern). The least invasive method is to keep access tokens short (minutes). When role changes, the client automatically gets a new token on next refresh cycle, picking up the new role. For immediate enforcement, use a blacklist or version check. Do not rely on long-lived tokens for permissions that can change frequently.

User role changes from Admin to User. JWT still says Admin. What do you do?

User role changes from Admin to User. JWT still says Admin. What do you do?

Scenario Questions

Follow-up Questions