The JWT generated by
cannot be undone unless the specified expiration time is reached. What makes this decision?
means that the expiration time is written in token
or associated with token
.
Is
determined by JWT's algorithm?
Yes
another question is, how does JWT verify that a Token is valid?
generally cleans up the expired token
regularly, and checks whether token
expires first when visiting.
I have noticed that the JWT, generated by the same data is determined to be invalid Token after the Node process is restarted. It looks like it's written into memory, but it's definitely impossible.
if it is not stored in a database such as redis/memcached
or something else, it can only be stored in memory. node
invalid process restart instructions are not stored outside the process, so it should be in memory.
it's not clear what you need to undo. If you want token
to expire, just change the key.
can't do self-undo, but you can do similar self-undo in another way. Here's what I did:
1, each token should have expiration time, one hour or ten hours, usually not permanently valid, I would rather give a token ten-day validity period, rather than do indefinitely.
2. If you need to undo a token, save the token in redis, and set the expiration time to avoid storing a large amount of token (this expiration time is larger than the expiration time of token)
3. Check whether the token exists in the redis before each verification: directly determine that the token; does not exist: continue to verify the validity of the token