Back to 20 Concepts
jwt-tokens • Advanced
JWT Revocation & Blacklisting: Short-Lived Tokens vs Redis Bloom Filters
Stateless JWTs cannot be revoked natively before their exp timestamp. Architectures enforce instant logout via Short-Lived Access Tokens (15 mins) + Refresh Token Rotation with Redis Blacklists or Bloom Filters.
Intuitive Mental Model
The 15-Minute Visitor Badge: Instead of issuing a permanent visitor pass that requires guards to check a 10,000-person banned list on every door, you issue a 15-minute temporary badge. If an employee is fired, their badge expires in minutes without global locks.
Architecture Blueprint & CodeProduction Standard
// Redis Token Blacklist on Instant Logout:
async function logoutUser(jti: string, exp: number) {
const ttlSeconds = Math.max(0, exp - Math.floor(Date.now() / 1000));
// Store revoked token JTI with remaining lifetime TTL:
await redis.set(`blacklist:${jti}`, 'revoked', 'EX', ttlSeconds);
}
// Fast In-Memory Check:
async function isTokenRevoked(jti: string): Promise<boolean> {
const result = await redis.get(`blacklist:${jti}`);
return result !== null;
}Key Architectural Takeaways
- •Short-Lived Access Tokens (10-15 mins): Limits the damage window of an unrevoked stolen token.
- •Refresh Token Rotation: Every refresh token use emits a NEW refresh token and invalidates the old one; reusing an old refresh token invalidates the entire token family (theft detection!).
Common Architectural Pitfall
Issuing stateless JWT access tokens with 30-day expiration times and no revocation mechanism.
Production Best Practice
Set access token expiration to 15 minutes, paired with rotating refresh tokens stored in HttpOnly cookies.