Defending Against JWT Attacks

In our previous lesson, we explored common JWT vulnerabilities, including the "None" Algorithm Attack and Weak Secret Keys. We saw how these vulnerabilities can be exploited by attackers to forge tokens and bypass authentication. Now that you understand these security risks, it's time to implement practical defenses to protect your applications.

One of the most significant challenges with JWTs is that they are stateless by design. Once issued, a JWT remains valid until it expires, even if a user logs out or their account is compromised. This creates a security gap where stolen tokens can be reused in replay attacks. Today, we'll focus on implementing token blacklisting as a key defense mechanism against these replay attacks.

It's important to note that blacklisting is not limited to logout scenarios. In real-world applications, tokens may also be blacklisted due to suspicious or abusive behavior, such as repeated failed login attempts, API overuse, or other patterns that indicate a potential attack. For example, if a token is used to make many unsuccessful requests in a short period, or if it triggers rate-limiting rules, it may be added to a blacklist to prevent further abuse.

Let's build a comprehensive JWT security system that addresses these concerns while maintaining the benefits of JWTs for authentication.

Token blacklisting allows us to invalidate specific tokens before they naturally expire. This is particularly useful when users log out, when you detect suspicious activity, or when tokens are involved in abuse patterns. By maintaining a list of invalidated tokens, we can check each incoming token against this blacklist and reject any that have been revoked, even if they haven't yet expired.

For our implementation, we'll use a simple in-memory data structure: a JavaScript Set. This is ideal for our blacklist in a demo or learning environment because:

1. It stores unique values (each token will only appear once).
2. It provides fast lookups (O(1) complexity).
3. It's easy to add and remove items.

// In-Memory Blacklist (Simple Set)
// Note: In production, use a persistent store like Redis or a database.
// This in-memory Set is for demonstration purposes only and only works on a single server.
const blacklistedTokens = new Set<string>();

This creates an empty Set that will store our blacklisted tokens as strings. In a production environment, you might want to use a more persistent solution like Redis or a database, but for our learning purposes, this in-memory solution works well.

Now that we have our blacklist structure, we need to determine when to add tokens to it. The most common scenario is when a user logs out. However, as mentioned earlier, you might also add tokens to the blacklist if you detect abuse patterns, such as many unsuccessful requests or API overuse.

Let's see how we can add a token to our blacklist:

// Add a token to the blacklist
blacklistedTokens.add(token);

This simple operation adds the token to our blacklist. Once a token is in the blacklist, we'll check against this list during the verification process to ensure that blacklisted tokens are rejected.

Now that we have our blacklist in place, we need to enhance our token verification process to check against this blacklist. This is typically done in a middleware function that runs before protected routes.

Let's implement a verification middleware that includes blacklist checking:

// Middleware to Check Blacklisted Tokens
const verifyToken = (req, res, next) => {
  const token = req.cookies.token;
  if (!token) return res.status(401).json({ error: 'Unauthorized' });

  if (blacklistedTokens.has(token)) {
    return res.status(401).json({ error: 'Token is blacklisted' });
  }

  try {
    const decoded = jwt.verify(token, JWT_SECRET_KEY) as jwt.JwtPayload;
    req.userId = decoded.userId;
    next();
  } catch (error) {
    res.status(401).json({ error: 'Invalid or expired token' });
  }
};

This middleware performs two essential security checks:

1. First, it checks if the token is in our blacklist. If it is, it immediately returns a 401 response, preventing access with revoked tokens.
2. Then, it verifies the token's signature and expiration using the JWT secret key.

By checking the blacklist early in the middleware, we efficiently reject revoked tokens before performing the more computationally expensive verification step.

Now that we have our blacklist and verification middleware in place, let's implement secure login and logout endpoints that work with our blacklisting system.

First, let's look at the login endpoint:

// Generate JWT Token
const generateToken = (userId: number) => {
  return jwt.sign({ userId }, JWT_SECRET_KEY, { expiresIn: '15m' });  // Short-lived token (15 minutes)
};

// Login Endpoint
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  const user = users.find(u => u.username === username);

  if (user && bcrypt.compareSync(password, user.password)) {
    const token = generateToken(user.id);
    res.cookie('token', token, { httpOnly: true });
    res.json({ message: 'Login successful', token });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

In this login endpoint, we:

1. Define a generateToken function that creates a JWT with a short expiration time (15 minutes). Short-lived tokens are a security best practice as they limit the window of opportunity for token theft and replay attacks. By default, the jsonwebtoken library uses the HS256 algorithm when no algorithm is specified.
2. Verify the user's credentials using bcrypt to compare the provided password with the stored hash.
3. If authentication succeeds, generate a token and set it as an HTTP-only cookie, which helps protect against XSS attacks.
4. Return a success message along with the token.

Now, let's implement the logout endpoint that adds the token to our blacklist:

// Logout Endpoint (Add Token to Blacklist)
app.post('/logout', (req, res) => {
  const token = req.cookies.token;
  if (!token) return res.status(400).json({ error: 'No token provided' });

  try {
    jwt.verify(token, JWT_SECRET_KEY); // Ensure the token is valid before blacklisting
    blacklistedTokens.add(token); // Add token to the blacklist
    res.clearCookie('token');
    res.json({ message: 'Successfully logged out' });
  } catch (error) {
    res.status(401).json({ error: 'Invalid token' });
  }
});

In this logout endpoint, we:

1. Extract the token from the request cookies.
2. Verify that the token is valid before adding it to the blacklist. This prevents potential denial-of-service attacks where an attacker might try to fill our blacklist with invalid tokens. Without this validation, attackers could submit countless invalid tokens, causing the blacklist to grow excessively, consuming memory and potentially degrading system performance.
3. Add the valid token to our blacklist.
4. Clear the token cookie from the client.
5. Return a success message.

This implementation ensures that when a user logs out, their token is immediately invalidated and cannot be used for future requests, even if it hasn't expired yet.

One challenge with token blacklisting is that the blacklist can grow indefinitely if we don't clean it up. Since tokens eventually expire, there's no need to keep them in the blacklist after their expiration time. To address this, we can implement an automatic cleanup mechanism that periodically removes expired tokens from our blacklist.

Here's how we can implement this cleanup process:

// Clear Expired Tokens from Blacklist (Optional)
setInterval(() => {
  blacklistedTokens.forEach((token) => {
    try {
      jwt.verify(token, JWT_SECRET_KEY); // If token is valid, keep it
    } catch (error) {
      blacklistedTokens.delete(token); // Remove expired tokens
    }
  });
}, 60000); // Run every 60 seconds

This code sets up an interval that runs every 60 seconds (1 minute). For each token in our blacklist, it attempts to verify the token. If verification fails (which would happen if the token has expired), it removes the token from the blacklist.

In this lesson, we implemented token blacklisting to defend against JWT replay attacks. We created an in-memory blacklist, enhanced our verification middleware, built secure login/logout endpoints, and set up automatic blacklist maintenance.

By invalidating tokens before they expire, we can protect our applications from unauthorized access even if tokens are stolen. This approach balances the stateless benefits of JWTs with the security needs of modern applications. Remember that in production environments, you'd want to use a persistent storage solution like Redis or a database instead of our in-memory implementation, and you may also blacklist tokens based on abuse patterns or suspicious activity.

Next, you'll practice implementing these defenses yourself. Let's dive in!