Token Revocation — Strategies for Revoking Auth Tokens

// JWT blacklist with Redis
async function revokeToken(jti, expiresIn) {
  await redis.set(`revoked:${jti}`, 'true', 'PX', expiresIn * 1000);
}

async function isTokenRevoked(jti) {
  return await redis.exists(`revoked:${jti}`);
}

// Token validation with revocation check
async function validateAndCheckRevoked(token) {
  const decoded = jwt.decode(token, { complete: true });
  if (!decoded) throw new Error('Invalid token');

  // Check revocation
  if (await isTokenRevoked(decoded.payload.jti)) {
    throw new Error('Token has been revoked');
  }

  return jwt.verify(token, publicKey, {
    algorithms: ['RS256'],
    issuer: 'https://auth.example.com',
    audience: 'https://api.example.com'
  });
}

// Emergency kill switch for tenant-wide revocation
async function revokeAllTenantTokens(tenantId) {
  const tokenIds = await redis.smembers(`tenant:${tenantId}:tokens`);
  for (const jti of tokenIds) {
    await revokeToken(jti, 86400);
  }
  await redis.del(`tenant:${tenantId}:tokens`);
}

// Bulk revocation for compromised client
app.post('/auth/admin/revoke-client', authenticate({ scopes: ['admin:auth'] }), async (req, res) => {
  const { clientId, reason } = req.body;
  const tokens = await tokenService.getAllTokensForClient(clientId);
  await Promise.all(tokens.map(t => revokeToken(t.jti, t.expiresIn)));
  await auditService.log('TOKEN_BULK_REVOKE', { clientId, reason, count: tokens.length });
  res.json({ revoked: tokens.length });
});