1

I have developed a oauth2 server in spring boot with jwt token , I am facing difficulty in logout .I have followed this link http://www.baeldung.com/spring-security-oauth-revoke-tokens

After logout if give the token in header and hit the /user it is giving all the user info instead it should throw and error saying the user is logged out

1 Answers1

4

Such a logout is not possible with JWT tokens.

JWT token is self-contained, which means that all information regarding the authentication are in the token itself. If you want to check, if a user is logged in, you just need to check the signature in the JWT token and the token expiration time. No communication with a server is required.

If you want to logout a user with JWT token, you need to delete the JWT token on the client side. And preferrably, the expiration time of JWT tokens should be rather short and the client should e.g. use refresh tokens to get new tokens.

To read more about JWT tokens, check out JWT.io.

Moreover, the guide you were using should not work for you, as it explicitely states:

Also note that this article only covers the standard token implementation in the framework, not JWT tokens.

Adam Kučera
  • 424
  • 5
  • 15