Krdytkyu

I wanted to use JWT (to learn it) in django-rest-framework instead of the built-in TokenAuthentication so I added django-rest-framework-simplejwt. The later provides two JWT tokens: a short-lived access token and a long-lived refresh token. However, tokens remain valid even after

1. user is deleted


2. password changes


3. permissions change

Blacklisting

I thought I'll blacklist the refresh token if necessary. Incoming refresh tokens would then need to be checked against a blacklist stored in the db (Horizontal scalability advantage lost?)

If admin deletes user X, how does he know what refresh token the user has so it can be blacklisted? Store all of that in the db too?

Use user_id?

The above JWT tokens include user_id by default. By checking user_id and the related permissions, I can deal with 1) and 3) above (although not 2). But this requires checking the db for every request.

Conclusion

The only advantage I can see in JWT now is that it can encode data, so the client might save a few requests. Seems very limited.

Built-in TokenAuthentication doesn't expire, but it seems better to extend TokenAuthentication and add expiration than use JWT to me right now. I am left confused why JWT is supposed to be industry best practice. Is it with different use cases in mind? But the requirement to invalidate tokens seems pertinent in any use case.

My Question

Any comments on what downside there is to using TokenAuthentication and why JWT is so big would be very welcome.