Intermediate LevelWeb Security & Cyber Defense
How does the jti (JWT ID) claim assist in tracking and revoking single-use tokens?
❓ Interview Prompt: Explain JWT `jti` claim, unique token IDs, preventing token replay attacks, and tracking single-use tokens in Redis.
The 'jti' (JWT ID) claim (RFC 7519) provides a unique identifier for a JSON Web Token:
Single-Use Token Pattern:
For sensitive operations (e.g. password reset tokens, email verification links):
1
Issue JWT with a UUID 'jti' claim: '{ "jti": "uuid_123", "exp": 1753700000 }'.
2
When the endpoint processes the token, it checks if 'jti' exists in Redis.
3
If 'jti' has already been used $\rightarrow$ Reject request!
4
If 'jti' is new $\rightarrow$ Process operation and store 'jti' in Redis until 'exp' time to block replay attempts.
Code Implementation Example
typescript
export async function consumeSingleUseToken(token: string) {
const payload = jwt.verify(token, secret) as { jti: string; exp: number };
const redisKey = 'used_jti:${payload.jti}';
// Check if token has already been consumed
const isUsed = await redis.exists(redisKey);
if (isUsed) throw new Error('Token has already been used');
// Mark jti as consumed until token expiration time
const ttl = payload.exp - Math.floor(Date.now() / 1000);
await redis.setex(redisKey, ttl, 'true');
}💡Consuming single-use JWTs by tracking used jti claims in Redis.
🎯 Interview Key Takeaway
Use the jti claim and Redis tracking to enforce single-use execution for sensitive JWT operations like password resets.
#JWT#jti#Replay Defense#Intermediate
Back to all Web Security & Cyber Defense Questions→