Issues with Refresh Token Expiry and Revocation in a Node.js Authentication System
I've looked through the documentation and I'm still confused about I've looked through the documentation and I'm still confused about I'm learning this framework and Hey everyone, I'm running into an issue that's driving me crazy... I'm sure I'm missing something obvious here, but I'm working on a personal project and I'm implementing a token-based authentication system in my Node.js application using Express and jsonwebtoken... Everything works well for initial access tokens, but I'm running into issues with managing refresh tokens effectively. When I attempt to revoke a refresh token after user logout, the token remains valid until its expiry time instead of being invalidated immediately. Here’s a snippet of my code where I generate the refresh token: ```javascript const jwt = require('jsonwebtoken'); const generateRefreshToken = (userId) => { return jwt.sign({ id: userId }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: '7d' }); }; ``` When the user logs out, I’m trying to remove their refresh token from the database: ```javascript app.post('/logout', async (req, res) => { const { refreshToken } = req.body; await TokenModel.deleteOne({ token: refreshToken }); res.sendStatus(204); }); ``` However, I still receive a 200 response when trying to use the revoked refresh token before its expiry. I expected the token to be invalidated immediately. To check the validity of the refresh token, I use this middleware: ```javascript const authenticateRefreshToken = (req, res, next) => { const token = req.body.refreshToken; if (!token) return res.sendStatus(401); jwt.verify(token, process.env.REFRESH_TOKEN_SECRET, (err, user) => { if (err) return res.sendStatus(403); req.user = user; next(); }); }; ``` I’ve tried implementing a blacklist mechanism, but I'm not sure how to efficiently check if the refresh token exists in the database before proceeding. Additionally, should I consider token storage strategies like a Redis store for better performance? Am I missing something fundamental in the token invalidation flow? Any insights or best practices would be greatly appreciated! This is part of a larger CLI tool I'm building. Am I missing something obvious? For context: I'm using Javascript on Windows. I'd really appreciate any guidance on this. My development environment is macOS. What's the best practice here? Is there a better approach?