JWT revocation

[sunithabprasad]

Hello,

what is the best approach to revoke json web tokens for mission critical applications.

could you please share any reference implementation you have for the proxies in Apigee for this.

[sidd-harth]

You can check below post,

https://community.apigee.com/questions/67382/how-to-invalidaterevoke-jwt-token-after-user-logou.html

Check Dino's answer and for sample proxy check my answer with proxy bundle.

[sunithabprasad]

Thank you for your response.

but was looking for a better solution. Per Dino's solution, JWTs should be maintained separately by us to track their status in cassandra? and cached ? and not looking to use cookies either

[dchiesa1]

JWTs should be maintained separately by us to track their status in cassandra?

What? No. Don't do that. JWT are federated tokens. Nobody needs to store anything. If you have the inclination to store complete JWT you are probably doing it wrong.