I wanted to use JWT (to learn it) in django-rest-framework instead of the built-in TokenAuthentication so I added django-rest-framework-simplejwt. The later provides two JWT tokens: a short-lived access token and a long-lived refresh token. However, tokens remain valid even after

  1. user is deleted
  2. password changes
  3. permissions change

Blacklisting

I thought I'll blacklist the refresh token if necessary. Incoming refresh tokens would then need to be checked against a blacklist stored in the db (Horizontal scalability advantage lost?)

If admin deletes user X, how does he know what refresh token the user has so it can be blacklisted? Store all of that in the db too?

Use user_id?

The above JWT tokens include user_id by default. By checking user_id and the related permissions, I can deal with 1) and 3) above (although not 2). But this requires checking the db for every request.

Conclusion

The only advantage I can see in JWT now is that it can encode data, so the client might save a few requests. Seems very limited.

Built-in TokenAuthentication doesn't expire, but it seems better to extend TokenAuthentication and add expiration than use JWT to me right now. I am left confused why JWT is supposed to be industry best practice. Is it with different use cases in mind? But the requirement to invalidate tokens seems pertinent in any use case.

My Question

Any comments on what downside there is to using TokenAuthentication and why JWT is so big would be very welcome.

put on hold as off-topic by 200_success, Martin R, Sᴀᴍ Onᴇᴌᴀ, vnp, Graipher yesterday

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Lacks concrete context: Code Review requires concrete code from a project, with sufficient context for reviewers to understand how that code is used. Pseudocode, stub code, hypothetical code, obfuscated code, and generic best practices are outside the scope of this site." – 200_success, Martin R, Sᴀᴍ Onᴇᴌᴀ, vnp
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question does not match what this site is about. Code Review is about improving existing, working code. Code Review is not the site to ask for help in fixing or changing what your code does. Once the code does what you want, we would love to help you do the same thing in a cleaner way! Please see our help center for more information. – Graipher yesterday
  • Okay, thank you. – M3RS 9 mins ago