How do you revoke JWTs?

Question

Accepted Answer

Because JWTs are stateless, they cannot be revoked directly. Practical revocation strategies involve adding a small stateful component. The most common methods are: (1) Token blacklist – store revoked token identifiers (JTI) in a fast cache like Redis; (2) User versioning – increment a version number in the user record and include it in the JWT; (3) Short-lived access tokens (5–15 minutes) with refresh token rotation – revoke the refresh token, forcing re-authentication. For massive scale, combine blacklist with versioning and short lifetimes to minimize the revocation window. ```javascript
// Login: embed current user version
const version = await redis.get(`user_version:${userId}`) || 0;
const token = jwt.sign({ sub: userId, ver: version }, secret, { expiresIn: '15m' });

// Middleware: validate version
const payload = jwt.verify(token, secret);
const currentVersion = await redis.get(`user_version:${payload.sub}`);
if (payload.ver !== currentVersion) return 401;

// Revoke all tokens for user (e.g., on role change or logout)
await redis.incr(`user_version:${userId}`);
```

How do you revoke JWTs?

Revoke JWTs by introducing a stateful revocation layer using a token blacklist (JTI), user versioning, or short-lived tokens with refresh token rotation.

Scenario Questions

Follow-up Questions