Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem I have with that is that the JWT expires after X minutes. Now my user have to perform the login again so he can browse the application.
I found a possible solution by using refresh tokens. Those should get another access token from the REST API after the previous access token expires. However, the refresh tokens also have expiration date. So the next option I found was to use some DB (for instance Redis) where I could store blacklisted tokens. But in the end of the day that is not stateless anymore. And what is the point of using blacklisting in that case why not use sessions?
There is a lot of similar questions on stack overflow or blog posts etc. But normally people parrot the line that REST API should be stateless and you should NOT use sessions in it - and that the JWT is the way to go. However on the other side a lot of posts also mentions that you should not use JWT-s for anything related to session management. However they never provide the alternative or "best practice".
So my questions are (I am mainly interested in question 3):
- how can you authorize the user to call REST API-s functions and also that you have the option to REVOKE that access when for instance user logs out, or when user changes the password?
- And if there is no way of managing sessions in the REST API, is REST API the right tool to use for my backend if I want to create for instance a mobile application and a website which consumes the same REST API?
- What is the best practice for authorizing a user in the scenario where you have to deal with user log out in a REST API?