I wanted to use JWT (to learn it) in
django-rest-framework instead of the built-in
TokenAuthentication so I added
django-rest-framework-simplejwt. The later provides two JWT tokens: a short-lived
access token and a long-lived
refresh token. However, tokens remain valid even after
- user is deleted
- password changes
- permissions change
I thought I'll blacklist the
refresh token if necessary. Incoming refresh tokens would then need to be checked against a blacklist stored in the
db (Horizontal scalability advantage lost?)
If admin deletes user X, how does he know what refresh token the user has so it can be blacklisted? Store all of that in the
The above JWT tokens include
user_id by default. By checking user_id and the related permissions, I can deal with 1) and 3) above (although not 2). But this requires checking the
db for every request.
The only advantage I can see in JWT now is that it can encode data, so the client might save a few requests. Seems very limited.
TokenAuthentication doesn't expire, but it seems better to extend
TokenAuthentication and add expiration than use JWT to me right now. I am left confused why JWT is supposed to be industry best practice. Is it with different use cases in mind? But the requirement to invalidate tokens seems pertinent in any use case.
Any comments on what downside there is to using
TokenAuthentication and why JWT is so big would be very welcome.