Intermediate LevelREST APIs & Web Services
How do you implement Token Revocation and Blacklisting for stateless JWTs?
❓ Interview Prompt: Explain stateless JWT revocation challenges, Redis token blacklisting using `jti` (JWT ID), and TTL expiration matching token lifetime.
Because JWTs are verified statelessly by checking cryptographic signatures, revoking a compromised JWT before its 'exp' timestamp requires an explicit revocation mechanism:
Redis Blacklisting Pattern:
1
Include a unique 'jti' (JWT ID) claim in every issued JWT.
2
When a user logs out or revokes access, store the 'jti' in a Redis key ('revoked:jti:val_123') with a TTL set to the token's remaining lifetime.
3
API Gateway / Auth Middleware checks Redis for 'jti' presence on incoming requests. If key exists in Redis $\rightarrow$ Reject with '401 Unauthorized'!
Code Implementation Example
typescript
import { Request, Response, NextFunction } from 'express';
import { redis } from './redis';
export async function verifyTokenBlacklist(req: Request, res: Response, next: NextFunction) {
const jti = req.user?.jti;
if (jti) {
const isRevoked = await redis.exists('revoked:jti:\${jti}');
if (isRevoked) return res.status(401).json({ error: 'Token has been revoked' });
}
next();
}💡Verifying JWT revocation blacklists in Redis middleware.
🎯 Interview Key Takeaway
Implement stateless JWT revocation by storing revoked JTI claims in Redis with TTLs set to token expiration lifetimes.
#JWT Revocation#Redis#Blacklisting#Intermediate
Back to all REST APIs & Web Services Questions→