Jwt-auth: Is it possible to invalidate all jwt tokens in a system?

[haji4ref]

Is it possible to invalidate all jwt tokens in a system?

Hi.
I want to invalidate all jwt tokens for a specific user if there is a record in my session table with that user's ip. Invalidate all tokens then login the user , generate a token for him then pass the token to the user.

Your environment

| Q | A
| ----------------- | ---
| Bug? | no
| New Feature? | no
| Framework | Laravel
| Framework version | 5.5.
| Package version | 0.5.12
| PHP version | 7.2.4

[HaiDang666]

I think you can add a custom claim like a flag in payload and check it in middleware

[robinpreetam]

How to invalidate all the existing tokens and logout all the already logged in user

1. Generate a new jwt secret.

php artisan jwt:generate

This will generate a new random key, which will be used to sign your tokens.

1. Update the newly generated key in the .env file

JWT_SECRET=<new_jwt_key>

1. Clear the application configuration and cache

php artisan config:clear
php artisan cache:clear

[Soulriser]

Regenerating the jwt secret is the nuclear option. Preferably it should be possible to invalidate all tokens, or a subset of user tokens, without generating a new secret.

[lowerends]

@Soulriser Can you explain why you call that a "nuclear option"? Are there any consequences with generating a new jwt secret?

[Soulriser]

Hi @lowerends. Regenerating the secret blows away all tokens, but the questioner asked about invalidating a subset (such as for a specific user or group of users). I don't mean to say it's bad or that there are specific negative consequences, so long as you know all of your users will have their sessions destroyed. It does seem to me, though, that having more programmatic control over token invalidation from within the JWT auth service would be desirable, rather than having to invoke Artisan.

[stale[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.