How to invalidate/revoke JWT token after user logout

[darpanjain420]

In my application APIGEE is used as the authentication layer for users. We are using JWT token as means for authentication at service end. There is a requirement such that if the user logs out and the JWT token is not expired, then the application should call the APIGEE edge for the invalidation of the JWT issued earlier.

Is there any way to achieve this scenario?

[dchiesa1 · Accepted solution]

JWT Cannot be invalidated. I have written about this elsewhere.

You can sort of simulate invalidation of a JWT, for a particular verifying party, by storing the JWT ID (jti claim) or equivalent, into a "revoked" list. For example, in a cache stored in Apigee Edge using the PopulateCache policy. Use a TTL that is longer than the JWT Expiry. (This will not work well if the JWT does not have an expiry!)

Then, to verify the JWT, you would need 2 steps in your API Proxy flow:

• extract the JTI (or other unique identifier) from the JWT using the DecodeJWT policy, and check the Revoked list (via the LookupCache policy) to see if that key is present. If it is present, then the JWT has been marked "revoked", so the API proxy should respond accordingly.
• otherwise use VerifyJWT as normal.

Any other party that verifies the JWT will not consider it to be revoked.