Logout failed about gin-jwt

[rohfle]

There are a couple of limitations that I can see with JWTs by default

• Tokens will continue to work until they timeout even after logout
• You can use a token that has been "logged out" to refresh indefinitely
• There is no way to tell how many sessions you have active

You would need some sort of storage (redis, database, memory) to track sessions and revoked / logged out tokens until they timeout

I think the way to get instant logout with the example is by storing the JWT in a cookie. But the token will still be valid if used in another way (header, query, or manually set cookie) until it times out

From docs:

PROVIDED: LogoutHandler

This is a provided function to be called on any logout endpoint, which will clear any cookies if SendCookie is set, and then call LogoutResponse.

The handler itself

func (mw *GinJWTMiddleware) LogoutHandler(c *gin.Context) {
	// delete auth cookie
	if mw.SendCookie {
		// ... Set cookie
	}

	mw.LogoutResponse(c, http.StatusOK)
}

Docs for setting the JWT in a cookie.
https://github.com/appleboy/gin-jwt#cookie-token

If SendCookie is not true then the JWT cookie will not be set.

[samsulbahari]

Have you found a solution?

[thangld322]

Can anyone answer please?