JWT how to kill sessions?

Question

JSON Web Token

I am using JWT for Authorization and I don't really understand. How can I reset all user sessions?
Of course, I can re-invent sessions and write data to the authorization database. But I think maybe there is a better solution?

Answer 1

JWT does not assume that it can be killed, it only provides for the expiration of the token according to the time that is wired in it.
If you want to manage the lifetime of the token yourself, then you need a ReferenceToken.
In this scenario, you only give the client a unique token id. The full token is stored in your database by this key and you have full control over its lifetime.
https://openiddict.github.io/openiddict-documentat...