Comments (3)
The bad news: there isn't a way to do this out of the box with JWT.
This is due to the fact that token based authentication is sateless. Which means we don't manage state (e.g. "is the user logged in") server-side, unlike a session does for example.
The benefits in term of simplicity and scalability of having a stateless API are significant, and in my opinion worth sacrificing a feature like force logout.
Trying to re-implement such a feature with a token blacklist for example is not a great idea as it means reintroducing state into your API, which makes token based authentication way less interesting.
A good alternative would be to keep token expiry times short and rotate them often.
Now the good news: I think there is a good way of implementing this.
Instead of storing the user id inside the token, you could store another field like a randomly generated unique lookup id. By changing this lookup id, you automatically invalidate any token previously generated for this user.
For the moment, knock always stores the id inside the payload. I'll make a quick change to allow this to be configured.
Let me know if something is unclear!
from knock.
@nsarno your was clear thanks!!!
About a way of implementing this.
The lookup where it could be save?
What do you think of saving the token in the database?
from knock.
The lookup where it could be save?
I would store the lookup id as another column in the user table.
What do you think of saving the token in the database?
This is not a good idea. It means an additional database query for every request. It also greatly reduce the benefits of not having to manage sessions. One of the biggest pros of using tokens is that you can tell if they are valid or not without storing them on the server.
from knock.
Related Issues (20)
- Support rails 6 autoload zeitwerk HOT 7
- Allow multiple token lifetimes HOT 5
- boolan params on token_payload
- Rails6: [WARNING] Could not load generator "generators/knock/install_generator". HOT 3
- Response with Bad Credencials HOT 2
- Config the entity model to a boolean param
- Rails 6 | ArgumentError (Befor authenticate_user e process_action callback :has not been defined): HOT 2
- Starting with Rails 6 | uninitialized constant Knock::Authenticable HOT 10
- Zeitwerk::NameError HOT 1
- Failing tests / CI build (uninitialized constant Knock::InstallGenerator) HOT 1
- How to override methods using Knock with Rails 6
- Crash if token_secret_signature_key returns empty string HOT 1
- Rails 5.2 heroku Jwt Knock issue
- How to use the NullUser pattern with Knock? HOT 2
- Knock not working in production / staging but just fine in develepment env? HOT 1
- Is there any proper document to integrate with Auth0 HOT 2
- Setting token lifetime according to user field
- Knock not returning token on user sign up HOT 2
- No routes generated?
- Make unmaintained state better visible? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from knock.