Giters

isopropylcyanide / Jwt-Spring-Security-JPA

Backend MVP showcasing JWT (Json Web Token) authentication with multiple login, timeout / refresh / logout (with in memory invalidation) using Spring Security & MySQL JPA.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Refresh Tokens

pedrogcsb opened this issue · comments

commented

Hey!

Any idea how can we remove / delete refresh token from DB if expired?

commented

Hi, this seems to be a task for a cleanup activity. Can be performed by any background asynchronous process. You can write a scheduled job or a cron that does it for you.

commented

I would suggest to store Refresh Token in Cache with TTL(Time to live) same as refresh token expiry, token gets deleted automatically when expired also there are some advantages using cache instead of DB for refresh tokens

commented

@abdurrehmansyeds Thanks. Although straightforward, purging refresh tokens is outside the scope of the initial project. A variant of this is already done here #13

commented

With #56 we now mark all reset tokens as inactive once claimed. Whatever that logic of purging expired refresh tokens be, it now should include all inactive tokens as well.