JWT without the pain: instantly invalidating all sessions
At WikiMind, we moved away from the classic JWT blacklist approach and implemented a per-user secret: each user has their own jwt_secret. One key in the database, and all old tokens die immediately.
In WikiMind, we moved away from the classic JWT blacklist approach and implemented a per-user secret: each user has their own jwt_secret. Need to log someone out everywhere? Just change one key in the database, and all old tokens die immediately. O(1) instead of dealing with lists that keep growing like legacy code after a “quick fix”.
How it works: first, we decode the token without verifying the signature, extract user_uuid, load the current jwt_secret from the database, and only then validate the signature. Yes, it sounds like a “hack”, but it’s a normal pattern as long as you don’t trust the payload until it’s fully verified.
For our 1200+ daily users, this is not something to “optimize later” — it’s part of the architecture. Especially now, when the IT world is talking more and more about zero trust and fast response to session compromise.