Wrong remaining minutes when blacklisting a token about jwt-auth

[amir-khoshbakht]

It also breaks the logout functionality

[amir-khoshbakht]

..... the "diffInRealMinutes" Carbon method is used, I didn't find it anywhere in Carbon's actual Doc
https://github.com/briannesbitt/Carbon/blob/34ccf6f6b49c915421c7886c88c0cb77f3ebbfd2/src/Carbon/Traits/Date.php#L2595

the "diffInRealMinutes" is the same as "diffInMinutes"

[elhannaoui-ayoub]

please how does the token invalidate works , do we store them in a table of balcklists or what?

[francsiswanto]

This is my solution and it's work.

• Create some providers to override existing Tymon\JWTAuth\Providers\Storage\Illuminate, let say name it as 'App\Storage\JWTStorage'. See script below.
• Publish jwt configuration
• Edit config/jwt.php and replace 'providers' as

(-) 'storage' => Tymon\JWTAuth\Providers\Storage\Illuminate::class,
(+) 'storage' => App\Storage\JWTStorage::class,

App\Storage\JWTStorage.php script:

namespace App\Storage;

use Tymon\JWTAuth\Providers\Storage\Illuminate;

class JWTStorage extends Illuminate {
    public function add($key, $value, $minutes) {
        parent::add($key, $value, abs($minutes));
    }
}

Since blacklisting/invalidating using cache mechanism, then artisan cache:clear will erase all blacklist entries. To avoid it, we can tweak above script to targeting into another store (example 'redis_blacklist'):

use Illuminate\Contracts\Cache\Repository as CacheContract;
use Tymon\JWTAuth\Providers\Storage\Illuminate;

class JWTStorageProvider extends Illuminate {
    protected $cache;

    public function __construct(CacheContract $cache) {
        $this->cache = cache()->store('redis_blacklist');
    }

    public function add($key, $value, $minutes) {
        parent::add($key, $value, abs($minutes));
    }
}

of course the solution above is better solved by jwt-auth, including changing the use of blacklist storage with config/jwt.php.

Just simply do the best, hoping for the best and let God take the rest.