Overview
src/auth/auth.service.ts generates access tokens with only {sub, email, role}. Without a jti (JWT ID) claim, the token blacklist cannot selectively revoke individual tokens — it can only revoke all tokens for a user. This makes targeted logout (e.g. "log out this specific device") impossible and forces a coarse-grained revocation strategy.
Specifications
Features:
- Include a unique
jti (UUID) in every access token payload.
- Use
jti as the blacklist key instead of userId.
Tasks:
- Import
randomUUID from crypto in auth.service.ts.
- Add
jti: randomUUID() to the access token payload in generateTokens().
- Update
TokenBlacklistService to blacklist by jti with TTL equal to token remaining lifetime.
- Update
JwtStrategy.validate() to check the jti against the blacklist on every request.
- Add unit tests verifying
jti uniqueness and blacklist behavior.
Impacted Files:
src/auth/auth.service.tssrc/auth/jwt.strategy.tssrc/security/token-blacklist/token-blacklist.service.ts
Acceptance Criteria
- Every issued access token contains a unique
jti.
- Blacklisting a
jti only invalidates that specific token, not all tokens for the user.
- Unit tests verify the blacklist lookup occurs on each authenticated request.
Overview
src/auth/auth.service.tsgenerates access tokens with only{sub, email, role}. Without ajti(JWT ID) claim, the token blacklist cannot selectively revoke individual tokens — it can only revoke all tokens for a user. This makes targeted logout (e.g. "log out this specific device") impossible and forces a coarse-grained revocation strategy.Specifications
Features:
jti(UUID) in every access token payload.jtias the blacklist key instead of userId.Tasks:
randomUUIDfromcryptoinauth.service.ts.jti: randomUUID()to the access token payload ingenerateTokens().TokenBlacklistServiceto blacklist byjtiwith TTL equal to token remaining lifetime.JwtStrategy.validate()to check thejtiagainst the blacklist on every request.jtiuniqueness and blacklist behavior.Impacted Files:
src/auth/auth.service.tssrc/auth/jwt.strategy.tssrc/security/token-blacklist/token-blacklist.service.tsAcceptance Criteria
jti.jtionly invalidates that specific token, not all tokens for the user.