Does it make sense to store JWT in a database?

spring rest security oauth-2.0 jwt
laurentius picture laurentius · Mar 13, 2017 · Viewed 34.4k times · Source

I've implemented a basic authentication system with Spring Boot, Spring Security, OAUTH2 and JWT as auth tokens. It works alright but I was thinking if it makes sense to store JWT in a database and check if a token exists every time someone makes an authenticated request using it? I was thinking specifically of the following scenario: user is authenticated in a mobile device and they lose it so they want to deauthorize that device. They would then be able to issue an operation that clears the tokens issued to their user id and deauthorize all tokens assigned to him. Any other way? Am I thinking this wrong or overcomplicating things?

This is for securing a REST API that is going to get called from a mobile APP.

Answer

sdoxsee picture sdoxsee · Mar 13, 2017

You could store the JWT in the db but you lose some of the benefits of a JWT. The JWT gives you the advantage of not needing to check the token in a db every time since you can just use cryptography to verify that the token is legitimate. If you have to look up the token in the db, you might as well just use an opaque token that doesn't carry information with it and let the server and database provide you with the information. On the other hand, if you're going to store a token in the db, I don't think a JWT is a bad choice for your token type. As you say, there are advantages for revocation if you store your token in the db. It all depends on what you want to achieve (faster authorization, etc. vs ability to revoke on demand).

You can still use JWT with OAuth2 without storing tokens in the db if you want. JWTs have a configurable expiry time that you can set--after which they are invalid. Access Tokens (whether JWT or not) should usually be short-lived for security. If the concern is someone's phone being stolen and access tokens being obtained, I think the solution is to have those tokens expire quickly (30 mins?). If you're using oauth2, the means of stopping someone from continuing to use the app is for the real owner to de-authorize the mobile app client on the authorization server so that no more access tokens will be given out.

Related questions

Spring RestTemplate GET with parameters

I have to make a REST call that includes custom headers and query parameters. I set my HttpEntity with just the headers (no body), and I use the RestTemplate.exchange() method as follows: HttpHeaders headers = new HttpHeaders(); headers.set("Accept", "…

Read More
How to set an "Accept:" header on Spring RestTemplate request?

I want to set the value of the Accept: in a request I am making using Spring's RestTemplate. Here is my Spring request handling code @RequestMapping( value= "/uom_matrix_save_or_edit", method = RequestMethod.POST, produces="application/json" ) public @ResponseBody …

Read More
Spring MVC - How to return simple String as JSON in Rest Controller

My question is essentially a follow-up to this question. @RestController public class TestController { @RequestMapping("/getString") public String getString() { return "Hello World"; } } In the above, Spring would add "Hello World" into the response body. How can I return a String as …

Read More