To use guardian db or not?

Do you use JWT for access token? Then how do you handle logout currently?

If you always look up access tokens when authenticating a request - then you can revoke all access tokens by removing them from the table. (whitelist approach)

If you only check JWT - then you have to implement blacklist, since JWT will be valid until it expires. Search “jwt logout”

Note:

• Both requires some state stored somewhere.
• Seems like guardian_db implements the first approach (whitelist) - keep the all issued tokens in the database.

The real question guardian_db asks is: whether to “revoke” JWT or not. If you’re not required to invalidate issued JWT, then you may just keep the JWT expires, and asks clients not to use it anymore. It solves most cases. However, in some cases.. you may be required to implement strictly “revoke” the issued token. In that case, you have to do either whiltelist or blacklist.

This sounds almost like using sessions ?

Because it is. JWT is terrible choice for user session management.

Just use plain old cookie with session ID and call it a day.

looks like a sane thing to do.
but this is primarily an API and would need to “stateless” .

If it requires guardian_db (and I assume has log-in feature) then it is not stateless.

mhm. got it !
if I store an API token for a user, is it considered stateless or not ?

If you store anything, such as revocation or validity, then it is not stateless since there is state.

Don’t use JWT/Guardian for stateful services. In general you should not use it at all unless you specifically require JWT for some reason (which is basically never).

Hmmmm… you store state of the user session, answer this question for yourself. I will just say that in reality there is very few truly stateless services, and in most cases you have stateful services.

I keep thinking JWT is a solution in search of a problem - maybe useful for giving a client access to a service - but for front end authentication? Seems a bit much… Would love to know what the advantage is over a token and a session. Or is it just that the front-end frameworks decided this would be how the world works and we all just have to jump to their tune?

is this the only way to invalidate the tokens ?

JWT are stateless. So you need a way to keep track of it.

So yes this general solution of keeping state is the only way.

The only good solution for JWT after help from this community and trying various libraries of login is API stuff. If you need user to login from a browser I would recommend the wonderful library POW.

No you do not need to keep track of it. If you keep track then you use stateful JWT, which removes all niceties of JWT.

Yes and no, it depends