DEV Community

Discussion on: How to log out when using JWT

View post
Collapse
 
yogeshkhater profile image
Yogesh Khater • • Edited

Another solution could be,

  • Store any random salt in user's DB record.
  • While encryption/decryption of the JWT tokens, we can use "your secret" + the salt.
  • On logout, update the salt.

It would make any existing JWT tokens invalid immediately without the need of a blacklist.

Collapse
 
bappy0 profile image
Rakib Hasan Bappy •

If I store a salt for each user in the DB, then we have to lookup in the DB in every request, right?
How does this approach (storing random salt for each user) optimize instead of blacklisting or any other approach?