Why can't JWT undo itself?

the generated JWT is irrevocable. What determines this? is it determined by JWT"s own algorithm?

another question is, how does JWT verify that a Token is valid?

the same header.payload.signature, generates a different token each time. How does it know that a certain token is valid?

Mar.24,2021

The JWT generated by
cannot be undone unless the specified expiration time is reached. What makes this decision?

means that the expiration time is written in token or associated with token .

Is
determined by JWT's algorithm?

Yes

another question is, how does JWT verify that a Token is valid?

generally cleans up the expired token regularly, and checks whether token expires first when visiting.

I have noticed that the JWT, generated by the same data is determined to be invalid Token after the Node process is restarted. It looks like it's written into memory, but it's definitely impossible.

if it is not stored in a database such as redis/memcached or something else, it can only be stored in memory. node invalid process restart instructions are not stored outside the process, so it should be in memory.

it's not clear what you need to undo. If you want token to expire, just change the key.


can't do self-undo, but you can do similar self-undo in another way. Here's what I did:

1, each token should have expiration time, one hour or ten hours, usually not permanently valid, I would rather give a token ten-day validity period, rather than do indefinitely.

2. If you need to undo a token, save the token in redis, and set the expiration time to avoid storing a large amount of token (this expiration time is larger than the expiration time of token)

3. Check whether the token exists in the redis before each verification: directly determine that the token; does not exist: continue to verify the validity of the token

Menu