spring boot oauth 2 server with jwt token logout -
i have developed oauth2 server in spring boot jwt token , facing difficulty in logout .i have followed link http://www.baeldung.com/spring-security-oauth-revoke-tokens
after logout if give token in header , hit /user giving user info instead should throw , error saying user logged out
such logout not possible jwt tokens.
jwt token self-contained, means information regarding authentication in token itself. if want check, if user logged in, need check signature in jwt token , token expiration time. no communication server required.
if want logout user jwt token, need delete jwt token on client side. , preferrably, expiration time of jwt tokens should rather short , client should e.g. use refresh tokens new tokens.
to read more jwt tokens, check out jwt.io.
moreover, guide using should not work you, explicitely states:
also note article covers standard token implementation in framework, not jwt tokens.
Comments
Post a Comment