JtiDenyList
in
Deny-list for the JWT `jti` claim.
On logout the jti is added with TTL = remaining exp - now, so the entry disappears
when the access token would expire anyway. JtiDenyListFactory picks the
implementation by the %useRedis% parameter in jwt.neon (RedisJtiDenyList,
DbJtiDenyList).
IMPORTANT: both implementations are fail-open. When the backend does not answer,
revoke() is a silent no-op and isRevoked() returns false, so a revoked token keeps
passing (signature and expiration are still checked) instead of failing with a 500.
Table of Contents
Methods
- isRevoked() : bool
- isUserRevoked() : bool
- Returns whether the user's token (claims `iat` and `exp`) is revoked by the stamp of {@see self::revokeUser()}.
- revoke() : void
- revokeUser() : void
- Revokes all access tokens of the user issued before the call (ban, password change or reset).
Methods
isRevoked()
public
isRevoked(string $jti) : bool
Parameters
- $jti : string
Return values
boolisUserRevoked()
Returns whether the user's token (claims `iat` and `exp`) is revoked by the stamp of {@see self::revokeUser()}.
public
isUserRevoked(int $userId, int $issuedAt, int $expiresAt) : bool
A token issued in the same second as the stamp stays valid, because after a password change the presenter issues a new pair in the same request.
Parameters
- $userId : int
- $issuedAt : int
- $expiresAt : int
Return values
boolrevoke()
public
revoke(string $jti, int $ttlSeconds) : void
Parameters
- $jti : string
- $ttlSeconds : int
revokeUser()
Revokes all access tokens of the user issued before the call (ban, password change or reset).
public
revokeUser(int $userId, int $ttlSeconds) : void
The jti of individual tokens is unknown at that moment, hence a per-user stamp. It
is kept for jwt.ttl ($ttlSeconds), after which no older token is valid anyway.
Parameters
- $userId : int
- $ttlSeconds : int