authentication - Could we destroy JWT token in Asp.NET Core? -

i use asp.net core & asp.net core identity generate jwt token.

in client side, react (spa) app call api create token include authorization: bearer tokenfromapi in subrequests.

when want logout how can expire token in server side?

currently delete bear token in client side , not included in next request?

reference: https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/

---

code in configure section in startup.cs

app.usejwtbearerauthentication(new jwtbeareroptions {     automaticauthenticate = true,     automaticchallenge = true,     tokenvalidationparameters = new tokenvalidationparameters     {         validissuer = "mysite",         validaudience = "mysite",         validateissuersigningkey = true,         issuersigningkey = new symmetricsecuritykey(encoding.utf8.getbytes("veryl0ngkeyv@lueth@tissecure")),         validatelifetime = true     } }); 

api create token

[httppost("token")] public async task<iactionresult> createtoken([frombody] loginmodel model) {     try     {         var user = await usermanager.findbynameasync(model.email);         if (passwordhasher.verifyhashedpassword(user, user.passwordhash, model.password) == passwordverificationresult.success)         {              var claims = new[]             {                 new claim(jwtregisteredclaimnames.sub, user.username),                 new claim(jwtregisteredclaimnames.jti, guid.newguid().tostring()),                 new claim(jwtregisteredclaimnames.email, user.email)             };              var key = new symmetricsecuritykey(encoding.utf8.getbytes("veryl0ngkeyv@lueth@tissecure"));             var creds = new signingcredentials(key, securityalgorithms.hmacsha256);             var token = new jwtsecuritytoken(                 "mysite",                 "mysite",                 claims,                 expires: datetime.utcnow.addminutes(45),                 signingcredentials: creds);              return ok(new             {                 token = new jwtsecuritytokenhandler().writetoken(token),                 expiration = token.validto,             });         }         return badrequest();     }     catch (exception ex)     {         logger.logerror(ex.tostring());         return statuscode((int)httpstatuscode.internalservererror);     } } 

you can't have expire, w/o losing of advantages of or making solution more complex.

best bet make access token time short enough (<= 5 mins) , refresh token long running.

but if want invalidate immediately, need few things:

1. cache token's id once token created duration long expiration time of token (both, access , refresh token)
2. [if farm/multiple instances]you need cache in distributed cache, redis
3. [if farm/multiple instances]you need propagate via message bus (i.e. using redis, rabbitmq or azure message bus) every instance of application, can store in local memory cache (so don't have have network call, each time want validate it)
4. during authorization, need validate if id still inside cache; if not, refuse authorization (401)
5. when user logs out, need remove item cache.
6. [if farm/multiple instances]remove item distributed cache , send message instances can remove local cache

other solutions not requiring message bus/distributable cache require contact auth server on every single request, killing main advantage of jwt token.

the main advantage of jwt self-contained , web service not have call service validate it. can validated locally validating signature (since token can't changed user w/o invalidating signature) , expiration time/audience token meant for.