How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?

Q: How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?

@Injectable() export class TokenRevocationService { constructor(private redis: Redis) {} async revoke(jti: string, expiresAt: number): Promise { const ttl = expiresAt - Math.floor(Date.now() / 1000); if (ttl > 0) await this.redis.setex(`revoked:${jti}`, ttl, '1'); } async isRevoked(jti: string): Promise { return (await this.redis.exists(`revoked:${jti}`)) === 1; } } // JwtStrategy — check revocation on every request @Injectable() export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') { async validate(payload: JwtPayload): Promise { if (await this.revocationService.isRevoked(payload.jti)) { throw new UnauthorizedException('Token has been revoked'); } return this.usersService.findOne(payload.sub); } } // Logout — revoke the current access token @Post('logout') @UseGuards(JwtAuthGuard) async logout(@CurrentUser() user: User, @Request() req) { const token = req.headers.authorization.split(' ')[1]; const { jti, exp } = this.jwt.decode(token) as any; await this.revocationService.revoke(jti, exp); return { message: 'Logged out' }; } Include jti (JWT ID) in every token payload — use randomUUID() to generate a unique identifier. TTL = token expiry - current time — the Redis key expires automatically when the token would have expired anyway. Redis EXISTS is O(1) and sub-millisecond — negligible overhead compared to a database lookup. This approach enables per-token revocation without invalidating all tokens for a user. For revoking all tokens of a user at once, store a revocation timestamp per user and compare against iat.

Difficulty: 7/10

JWT revocation, NestJS guards, Distributed cache

Store revoked JWT IDs (jti) in Redis with a TTL equal to the token's remaining lifetime. In JwtStrategy.validate(), check Redis for the jti before trusting the token. Redis lookups are sub-millisecond — far cheaper than database queries. When the token expires naturally, the Redis key expires too, keeping the blacklist lean.

Redis-based token revocation with jti

Token revocation implementation notes:

1
Include jti (JWT ID) in every token payload — use randomUUID() to generate a unique identifier.
2

How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?

Difficulty: 7/10

JWT revocation, NestJS guards, Distributed cache

Store revoked JWT IDs (jti) in Redis with a TTL equal to the token's remaining lifetime. In JwtStrategy.validate(), check Redis for the jti before trusting the token. Redis lookups are sub-millisecond — far cheaper than database queries. When the token expires naturally, the Redis key expires too, keeping the blacklist lean.

Redis-based token revocation with jti

Token revocation implementation notes:

1
Include jti (JWT ID) in every token payload — use randomUUID() to generate a unique identifier.
2

How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?

How do you implement JWT token revocation (blacklisting) without a database lookup on every request in NestJS?

Scenario Questions

Follow-up Questions