RedisJtiDenyList
in package
implements
JtiDenyList
FinalYes
Redis-backed deny-list.
The key self::KEY_PREFIXsetex), so entries
expire without a cron.
IMPORTANT: fail-open. When the Predis service is unavailable (null) or Redis fails,
revoke() is a no-op and isRevoked() returns false, so a revoked token keeps passing.
Table of Contents
Interfaces
- JtiDenyList
- Deny-list for the JWT `jti` claim.
Constants
- KEY_PREFIX : mixed = 'jwt:denylist:'
- USER_KEY_PREFIX : mixed = 'jwt:user-revoked:'
- Stamp meaning "tokens of the user issued before this time are invalid" (value = unix time).
Properties
- $redis : Client|null
Methods
- __construct() : mixed
- isRevoked() : bool
- isUserRevoked() : bool
- Costs one GET per request, the same as the `jti` check.
- revoke() : void
- revokeUser() : void
- Revokes all access tokens of the user issued before the call (ban, password change or reset).
Constants
KEY_PREFIX
private
mixed
KEY_PREFIX
= 'jwt:denylist:'
USER_KEY_PREFIX
Stamp meaning "tokens of the user issued before this time are invalid" (value = unix time).
private
mixed
USER_KEY_PREFIX
= 'jwt:user-revoked:'
Properties
$redis read-only
private
Client|null
$redis
= null
Methods
__construct()
public
__construct([Client|null $redis = null ]) : mixed
Parameters
- $redis : Client|null = null
isRevoked()
public
isRevoked(string $jti) : bool
Parameters
- $jti : string
Return values
boolisUserRevoked()
Costs one GET per request, the same as the `jti` check.
public
isUserRevoked(int $userId, int $issuedAt, int $expiresAt) : bool
Parameters
- $userId : int
- $issuedAt : int
- $expiresAt : int
Return values
boolrevoke()
public
revoke(string $jti, int $ttlSeconds) : void
Parameters
- $jti : string
- $ttlSeconds : int
revokeUser()
Revokes all access tokens of the user issued before the call (ban, password change or reset).
public
revokeUser(int $userId, int $ttlSeconds) : void
The jti of individual tokens is unknown at that moment, hence a per-user stamp. It
is kept for jwt.ttl ($ttlSeconds), after which no older token is valid anyway.
Parameters
- $userId : int
- $ttlSeconds : int