I will be using JWT for authentication for my REST API. I am using third party cloud services and database write are very expensive so I am trying to avoid writing to the database as much as I can. Due to this I want to avoid using a refresh token because that way I would have to frequently update the database (writing is almost 10x more expensive than reading). My general plan for authentication flow is the following:

1)User registers (assuming email authentication is complete and all) and the following database table gets populated as such:

| Username | HashedPassword | TokenIncrement | AccountStatus
   Bob     |   someGiberish |       1        |    Valid

2) Server generates a token which is valid for 15 minutes. It has a TokenIncrement field labelled as 1

3) User interacts with my application using the token

4) The token has expired

5) User attempts to use the expired token

6) The server detects it is expired (everything such as issuer, subject, etc are otherwise valid).

7) The server will not refresh this token.

8) The server reads the database for this user. It sees the the account is valid and that the token increment is equal to 1. This is the same information which is stored on the token so the server creates a new token for the user.

9) Along the way the token is stolen (or the user thinks it is) so they report their account has been hacked. 10) This stolen token can be used then to keep doing malicious stuff and can be constantly refreshed until the account has been deemed to be doing suspicious activity. 10) My server then would increment the database table field TokenIncrement to 2.

11) Now all old token would not be able to be refreshed because they would have a TokenIncrement of 1. This means when they were being verified the token would say 1, but the database would show 2, they would not match.

12) The valid user would sign in again and get the proper token with the increment showing 2 and be able to do whatever they need to do.

With this method the only time I would need a database write is when an account is hacked, opposed to updating the database every time the refresh token expires.

Besides the inherited security downfalls of JWT, is there any obvious holes in this strategy (I understand nothing is ever really secure)?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.