Handling Token Revocation at Scale

In this lesson, you will learn how to build a high-performance blacklist mechanism to invalidate JSON Web Tokens (JWTs) before their natural expiration date.

The Challenge of Statelessness

One of the primary benefits of JWTs is that they are stateless—the server doesn't need to look up a session in a database for every request. However, this becomes a security liability if a user logs out or a token is stolen. Since the server trusts the token until it expires, you need a way to "revoke" specific tokens without sacrificing the performance benefits of stateless authentication.

Implementing the Blacklist

To revoke a token, you must create a blacklist, typically stored in a fast, in-memory data store like Redis. Instead of checking a database for every request, you check the blacklist for the token's unique identifier (jti or JWT ID).

1. Include a jti in your JWT claims when you sign it.
2. On Logout/Revocation: Store the jti in Redis with an expiration time that matches the remaining life of the token.
3. On Authentication: Add a middleware layer to your Node.js application that checks if the incoming token’s jti exists in the Redis blacklist.

// Middleware to check if token is blacklisted
const checkBlacklist = async (req, res, next) => {
  const tokenJti = req.user.jti;
  const isBlacklisted = await redisClient.get(`blacklist:${tokenJti}`);

  if (isBlacklisted) {
    return res.status(401).json({ error: 'Token has been revoked' });
  }
  next();
};

Scaling Considerations

Using Redis for this process is essential at scale because its sub-millisecond latency ensures your authentication check doesn't become a bottleneck. By setting the Redis key's time-to-live (TTL) to equal the time remaining on the token, the blacklist automatically prunes itself, keeping your memory usage predictable. This pattern allows you to maintain the "stateless" nature of JWTs while gaining the ability to react immediately to security threats or user-initiated logouts.

Key Takeaway: By storing the unique jti of revoked tokens in a high-speed, expiring cache like Redis, you can effectively invalidate tokens at scale without sacrificing the performance of your authentication flow.