79595963

Date: 2025-04-28 07:20:37
Score: 1
Natty:
Report link

After careful consideration, I decided using the same jti for my both access and refresh tokens.

  1. When a user logs in, i just index the new jti to the user in redis.
  2. When a user log out, i just blacklist the jti with ttl + (REFRESH_TTL - ACCESS_TTL)
  3. When a user refreshes, it's the combination of 2 sections above.

I'm not really sure what could go wrong in using the same jti from access and refresh tokens. This seems like a valid and optimized approach. We don't care about getting the refresh tokens when user logs out, or our prior access token is no longer valid like it's supposed to be when we refresh the token. Please enlighten me if you have any notes on this.

Reasons:
  • Long answer (-0.5):
  • No code block (0.5):
  • Low reputation (1):
Posted by: dereo