Beginner LevelAuthentication & Authorization
How do you implement Logout for Stateful Sessions versus Stateless JWTs?
❓ Interview Prompt: Compare destroying stateful server sessions vs blacklisting stateless JWTs upon user logout.
Handling user logout differs significantly depending on the underlying session architecture:
1. Stateful Sessions:
•
Server Action: Delete the session record from Redis or server RAM immediately.
•
Client Action: Clear the session cookie via 'Set-Cookie' with an expired date.
•
Result: Instant, 100% reliable revocation across all endpoints.
2. Stateless JWTs:
•
Client Action: Clear tokens from local memory/cookies.
•
Server Challenge: Because JWTs are stateless, a leaked token remains valid until its natural 'exp' time!
•
Server Revocation Solution: Store the token's unique identifier ('jti') in a Redis Revocation Blacklist until the token's natural expiration time passes.
Code Implementation Example
typescript
// Blacklisting JWT jti claim in Redis on logout
async function logoutJwt(token: string) {
const decoded = jwt.decode(token) as { jti: string; exp: number };
const ttlSeconds = decoded.exp - Math.floor(Date.now() / 1000);
if (ttlSeconds > 0) {
// Add jti to Redis blacklist for remaining token TTL duration
await redisClient.set("blacklist:" + decoded.jti, "true", { EX: ttlSeconds });
}
}💡Blacklisting JWT jti token identifier in Redis until expiration TTL.
🎯 Interview Key Takeaway
Stateful logout deletes server session records; stateless JWT logout requires adding the token jti to a Redis blacklist.
#Logout#Revocation#Redis#JWT#Beginner
Back to all Authentication & Authorization Questions→