How to Logout from Spring Security - JWT

[@BoualiAli]

COUPON Code: *EARLYBIRD20* => Spring Data J PA course: aliboucoding.com/p/the-full-guide-to-master-spring-boot-data-jpa

[@michealjohn5288]

He is the best Teacher on spring security. i will recommend you anytime and anywhere

[@BoualiAli]

Thank you 🙏. Really appreciate that

[@mfarooqwasi]

Great teacher with clear voice and content, making the life easier for the spring boot developers, great contribution and highly appreciated. Thank you so much 🥰

[@khanghoang3289]

Thanks for this lecture. With this lecture, I can understand how JWT and Spring Security combines together in order to build the security's structure in Spring Boot. Finally, you are the best teachers, you are a lifesaver with me

[@Michaeljamieson10]

These are amazing! Refresh tokens would be very useful !

[@BoualiAli]

Thanks. I will create a video about that fir sure

[@saqib-fi4bd]

Thank you so much for these updated videos. You have no idea how frustrated I got due to the out dated ones when working with Spring boot 3. you're helping me in both my full time job and in my freelance projects especially when it came to security of APIs. Bundle of Thanks

[@BoualiAli]

Glad I could help!

[@erictchindje9765]

Thanks you sir. You explain the hight concept in the simple and amazing way.

[@flyh21c]

You are the best! Thanks a lot! Mentions every side of the JWT. Basics, logout, refresh token, password change etc...

[@BoualiAli]

Happy you liked it!

[@MohitSharma-uq2vm]

You saved me from my boss's anger.thankyou very much🙏

[@BoualiAli]

Most welcome 😊

[@aziztolearn]

Excellent videos and playlist! 👍👍👍👍

[@MarkSatin1]

Thank you so much for this and your other Spring Security videos! You break down overwhelming concepts into clear smaller pieces so easily. I learned so much from just going through a couple of your videos. Looking forward to watching more!

[@BoualiAli]

Glad you like them! This motivates me

[@FilipPolitowski]

This is the best video about Spring Security and JWT. Thanks a lot for this lesson, it helped me incredibly :)

[@yosr.]

tbarkallah 3la weld bledi thank you so much Ali you're a lifesaver

[@BoualiAli]

Thank youu 🙏 My pleasure

[@anirudh514]

Thank you so much, very well explained!

[@choooaround]

Thanks, your video goes at a very good pace with clear explanations. Apart from a couple of deprecated codes, it was great. Thanks for your help!

[@BoualiAli]

deprecations are inevitable. I always release new videos for the updates. check the playlists or search in the channel

[@errahulrajocjp]

you have saved the IT Industry, Sir!!

[@BoualiAli]

Glad you liked it!

[@AmineCch2t]

Hi from Morocco, ur spring security tutorial are perfect, thank you for ur help.

[@BoualiAli]

Glad you like them!

[@mohammadobeidat5685]

Mashallah, thank you my brother for the clear step-by-step tutorial. Keep it up!

[@BoualiAli]

My pleasure!

[@HYR0720]

You are so wonderful! you teaching is very easy to understand. I watched your video 4 about spring security and i added more to watch them later!

[@BoualiAli]

Really happy you liked it

[@devynlab]

Just finished watching the previous video implementing JWT, and adding this on top of that I've learnt a lot. Super thanks man 🔥.

[@BoualiAli]

Happy to know that. Happy you liked it

[@mohamednaitmoussa2600]

the best one teaching spring 🔥🔥

[@BoualiAli]

Wow, thanks!

[@sandeepkumar-yz6lw]

Thankyou Sir for sharing your knowledge.

[@BoualiAli]

My pleasure

[@sharathkumar2018]

A lot of videos out there which rarely explain about logout! thanks a lot for this amazing video 🙏

[@BoualiAli]

Happy you loved it 😊

[@mrpipiskin4]

Thaks for your job. These guides save a lot of time for beginners

[@BoualiAli]

Happy you liked it

[@soukainaj]

Thank you for the amazing tutorial

[@mukhammadnajimov8440]

That's soo coool, that you provide such really helpful videos and contents Thank you so much Sir

[@BoualiAli]

Glad you like them!

[@vadimsirenko6966]

Hello from Russia, man. Thanks for your very helpful videos.

[@BoualiAli]

Greetings from Tunisia 🇹🇳 Happy you like my content

[@dipak-t6v]

wonderfull !!! what a enrgy sir. Appriciated....

[@BoualiAli]

So nice of you

[@kdvamja]

Such amazing and useful content and a better way to explain it in an easy way. We love your work and efforts. Thank you for such amazing content like this ❤.

[@BoualiAli]

Happy you liked it

[@pateldharmesh1361]

It really cool and superb content.

[@BoualiAli]

Happy you liked it!

[@behzadfazelasl9581]

Very useful and clear explanation. Thanks Ali

[@BoualiAli]

Glad it was helpful!

[@ismailforeveryone6889]

Amazing please keep going this topic of security is very rare, specially with this updates of spring security 6

[@BoualiAli]

Thank you, I will

[@ismailforeveryone6889]

@@BoualiAli Thank you so much Mr

[@shraddhaparajuli7531]

Applause to your effort. Need to say this video is really informative and helped me extremely for implementing logout with jwt tokens. It would be really helpful if you could start a youtube series on implementing the microservices with all the features provided by spring cloud.

[@BoualiAli]

I already started preparing for such course. Preparation take really long time

[@DurgeshChaubey-o2k]

Thank you so much loved the video. I was stuck and looking for a resource. It helped me alot. Love from India

[@BoualiAli]

Happy to have you here. Happy you like my content

[@mouradeljayi584]

Amazing, Thank you and please keep uploading videos like this cause we really learn a lot from you .

[@BoualiAli]

Thanks 🙏 I will absolutely continue uploading. You’re my source of motivation

[@serdarsen6099]

Thank you so much for this and your other Spring Security videos! Your work is truly wonderful; please keep it up!

[@BoualiAli]

Thank you! Will do!

[@amirkenesbay1615]

Wow broooo u r amazing. This tutorial helped me to solve my problem in my project))

[@BoualiAli]

Happy to know that bro.

[@sekharjamallamudi9531]

so much thankful to you sir giving this videos very useful for me. Sir pls do video on forgot reset password

[@BoualiAli]

Already done. Subscribe and enable the notifications and you won't miss any of my new videos

[@nuhali4729]

Thanks for this video Ali !

[@BoualiAli]

My pleasure

[@lowCostCoder]

it was really a great tutorial. Thanks for sharing your knowledge with us

[@adilhanoun975]

Bonjour Mr Bouali j'ai cru comprendre que stocker le JWT en Bdd pouvais être vu comme une mauvaise pratique pour des soucis de performance comment contré cette argument ? MERCI A VOUS

[@meetsamseen]

Awesome tutorial man! 48:20 was spot on, you got me right there.

[@BoualiAli]

Awesome, thank you!

[@mustafasametsonmez7034]

These videos are amazing thanks a lot. I searched many videos about jwt security in java spring boot but they wasn't easy to understand but I can learn easily and clearly with your videos thanks. access and refresh token would be great

[@BoualiAli]

Thank you for the good feedback. I will make a video about refresh token

[@ВолодимирЖуківський]

Топ контент. Дякую

[@BoualiAli]

my pleasure!

[@iivailo94]

really useful videos, keep going! I appreciate your course videos

[@BoualiAli]

I’m really happy that you like my content. This motivates me to create more

[@erichhc9698]

excellent Ali, I don't miss any video I learn a lot from you 😎

[@BoualiAli]

Happy to know that. This motivates me

[@bartdiako1]

Thanks Bouali ! this Security vids have been a great help ❤. You are awsome!!! Just wondering if you're going to do a change password vid to? forgotten password and e mail verification ?

[@BoualiAli]

Yes I will

[@sheldonlawrence8798]

Excellent, a video on refresh token would help

[@BoualiAli]

Thanks, I will create one

[@arohawrami8132]

Thanks a lot Bouali. It was very beneficial as always. I really admire your high quality work and please continue creating more content.

[@BoualiAli]

Happy you liked it

[@arohawrami8132]

@@BoualiAli Thank you Ali

[@mmge3967]

Thanks for your effort in jwt. But i want to ask you a simple question Should we delete the previous tokens for specific user so we don't have alot of rows that we don't need in the database or not? Thanks in advance.

[@BoualiAli]

This also can be an option if you don’t need the already revoked token

[@mmge3967]

@@BoualiAli ok thanks

[@ramakrishnamogilipuri1647]

nice content.thank you

[@BoualiAli]

Glad you liked it!

[@ramakrishnamogilipuri1647]

Can you also make videos for Authorization using database roles instead of enum

[@BoualiAli]

@@ramakrishnamogilipuri1647 will do that

[@boubacarbarry222]

Thank you again, it's very clear !

[@BoualiAli]

My pleasure ❤️

[@osekagorska2330]

Well done, keep up the amazing work!

[@BoualiAli]

Thanks, will do!

[@НорбертТовт]

Helpful and useful video , but it could be in easier way, you could create a new method called logout , then decode jwt , then change it date and it is all . Your explaining is very clear . Thank you

[@BoualiAli]

Thanks for the comment. Just one question regarding you way of doing it. How would you for the user to update the token? (Token is stored on client side)

[@kevinameda2711]

Thank you brother, this is inspiring and realy helped me a lot thank you. Can you pls help create a lecture for messaging queues like kafka or rabbitMQ? Stay blessed

[@BoualiAli]

Thank you for the feedback. MQ is coming soon

[@michaelroyf4766]

Thanks for the video! I just didn't understand why we need to create a token during registration. and what about the refresh token?

[@BoualiAli]

The token in the registration is just to avoid re logging Refresh token will come soon

[@arsalansarwer]

great tutorial, and code works fine

[@BoualiAli]

Happy to know that

[@etodemerzel1011]

Perfection !!!! 👍

[@BoualiAli]

Glad you like it!

[@jeanmorisanato6458]

Thanks for his sweet video

[@BoualiAli]

Happy you liked it

[@developers1081]

Thax Sir Realy Helped

[@BoualiAli]

Happy you liked it

[@VitaliiSmahlenko-i5h]

Very cool explained everything thank you!!! One question. Isn't it more logical to just delete tokens so as not to store a bunch of invalid tokens in the database?

[@medAmineRg]

i guess you can do it. it just a matter of history

[@coralie5093]

Thank you. Good job!

[@BoualiAli]

Glad it was helpful!

[@bogdanjovanovic2737]

16:50 The query will return the tokens for the user that are either not expired or not revoked which means that will include tokens that are expired but not revoked, as well as tokens that are revoked but not expired. Was that the intention or we should return tokens that are neither expired nor revoked? For example instead of: ``` where u.id =:userId and (t.expired = false or t.revoked = false) ``` We can return non-expired and non-revoked tokens: ``` where u.id = :userId and t.expired = false and t.revoked = false ```

[@KhalilChargui-jm1fj]

Amazing, Thank you

[@programming97]

great

[@augustinegoat]

Thank you for your tutorial, I have a question that if every time the user authenticates and logs out, the token will be set revoked to false and expired is also false, but if that is the case, the database will contain corrupted fields. It's redundant and makes the database bigger when having to store the data. Can I clean up that extra data?

[@JasmineTrader-mw8ru]

Awesome tutorial. I have one big doubt, I've seen lots of peopke saying its not secure to store tokens in the database. I am wondering the reason why you are doing this?

[@BoualiAli]

As I mentioned, there is no implicit implementation for logout (jwt) and that is one simple solution. You can performa a daily cleanup for revoked / invalid tokens from the database

[@JasmineTrader-mw8ru]

@@BoualiAli yes i understand that. But i do not want to store the valid tokens in database either for security reasons. Can you suggest me a way to revoke a token in the backend? Id there anyway we can remove the jwt from security context holder?

[@inderpreetsingh5126]

Thanks and Keep It Up Bro

[@BoualiAli]

Thank you. I will

[@hafedhbaazouzi3617]

Good Job Thanks

[@BoualiAli]

My pleasure

[@lucasmagalhaes1573]

Hello Bouali! Great tutorial as always, thank you! Quick question: doesn't revoking the user's token on every authentication forbids them to log in to the application in different devices at the same time?

[@BoualiAli]

Yes, true

[@theold_new1631]

Thank you for the video! I have a question. When I log out, Are the tokens just left permanently in the database? I am curious about what processing is common in a practical environment.

[@BoualiAli]

you can create a script to clean the DB. By the way, Better use keycloak I will release a new video next week

[@thapelomusic1209]

Good tutorial. I have a question. the way in which this is implemented does it mean a user cant log in many devices ? Because the way I see it every time you log into another device all the other devices are logged out automatically

[@bartosztoropolski8191]

Great tutorial! Will you create video about refresh token?

[@BoualiAli]

Happy you like it. I will soon

[@sovannborithyun5205]

Excellence video. Would you create a video using Angular to logout?

[@BoualiAli]

Great suggestion!

[@hamidoubalde2517]

great video @Ali Bouali. I have a question. For you what is best for implementing jwt between custom jwt like you did or use Oath2 resource server which hold jwt implementation. In the last case how to implement logout? Thanks

[@BoualiAli]

Both of them are jwt based. You can use both of them I’m working on a new course that covers both, jwt and oauth 2 with a frontend built with angular. I will publish the a waiting list soon enough so you can register and get discount

[@hamidoubalde2517]

@@BoualiAli thanks

[@infinity2471]

¡Gracias!

[@BoualiAli]

Thank you so much for the support. This is so generous from you.

[@دردشةفيالهوى]

thank you so much

[@Ideastoriesenglish]

Thank you so much!

[@BoualiAli]

You’re welcome

[@autogenes]

Nice one :)

[@manospat1066]

Amazing work! Just a question, why we generate jwt token both in register and the authenticate methods? In my understanding, in register the token is generated and then in each coming request user must pass the jwt token. Also, I thought that one user has only one token associated with him, so the relationship between user-token should be one-to-one and not one-to-many? Thanks

[@BoualiAli]

Totally true what you said. Just as I mentioned in the video, it is just for the tutorial to have a token after registration. But in real life no need for it. Feel free to adjust ass you need

[@hasanfarooqui2250]

1) What is the use of revoking and expiring all tokens during JWT creation ( you have already done it in LogoutService class) Why doing twice ? 2)In this application user can not simultaneously login from two device ? (As soon as he login on another device, you are simply revoking all its previous tokens). Is above questions are valid or am I missing anything ? btw lecture is very helpful. Thank you.

[@balazsvarga4216]

I watched also the prev video about JWT. This videos are very straightforward and to the point. Just a little bit remark: why do you use var declaration instead of naming the proper type?

[@BoualiAli]

It is just shorter to write 😅

[@saifchtourou5083]

Good Job !

[@BoualiAli]

Thank bro

[@sidof8065]

Thanks for the tutorial. i have some question How allow access to another resource like /api/v1/course when we already been logged (api/v1/auth/) with token. so we will not provide a token any time to another resource ?

[@BoualiAli]

For secured resources, you need to always pass the token

[@sidof8065]

@@BoualiAli okay sir i noticed

[@poojabondkar4983]

Thank you so much AliBou !! This is very helpful. can you make video of logout from Keycloak auth server generating jwt token ?

[@BoualiAli]

Yes, soon

[@alifka6815]

Thanks for the informative video, the only thing I did not understand is why we do the same checks in LogoutHandler as in the filter, because if there is no Authorization header or it does not start with Bearer, then the filter will not skip this request, and if the filter missed us in EndPoint /logout, it means that the Authorization header is there and the token starts with Bearer and it is also not zero, am I right?

[@mbilal6462]

i think that in the LogoutService before clearing the SecurityContextHolder, in addition to checking for the existence of the token in our database, we should also check that it's not been revoked or expired.

[@tugbakoc379]

thank you!!

[@BoualiAli]

welcome

[@khalilmarzouki636]

good job, keep going ali 🤩🤩

[@BoualiAli]

Thank you 🙏

[@amradel6030]

thank you so much

[@BoualiAli]

You're welcome!

[@egbe-iyonmichael5119]

You are awesome

[@antoniodevic8704]

Thanks for the video, a lot of useful info in it! One question though, is with JWT tokens since they are stateless logout part on backend really necessary? Can it present any security issue or is it just enough to stop user from accessing secured resources if it is handled on frontend, invalidated there or deleted from local storage?

[@BoualiAli]

It is also enough to delete it from local storage in the frontend. But this a double check and total logout and revoking the token. Many have request such functionality, so I answered the call 😁

[@antoniodevic8704]

@@BoualiAli Thanks for the quick answer! Sure, double check can't definitely hurt :D

[@migolovach1371]

Very helpful video. I have only one question, maybe I don’t understand something, but why store expired tokens.

[@BoualiAli]

You remove expired token. In a different context. You might use them for auditing and tracing (maybe)

[@GoncaloSilva137]

Hi, are we updating the database accessToken expired parameter when the accessTokenExpiration time finish ?

[@BoualiAli]

I didn’t get your question can you please elaborate more?

[@MuhammadAli-rp9cz]

Hi Bouali - Thanks for the amazing videos on Jwt. My question - in the first video, why are you only checking that token belongs to the user and does not expire during validation? Where does the secret key and the signature plays a role during validation? Can't i just create my own token and map to a valid and it will still be marked as valid?

[@BoualiAli]

Decoding the token uses the secret that you generated. And it should be a secret of course 😁 To have your answer, I would ask you to generate a random token with a different secret ( you can use jwt.io website for that) and pass it to the backend and then you will see if it passes or not. Reply to this comment with your feedback. Looking forward for the result 🤛

[@MuhammadAli-rp9cz]

@@BoualiAli Tested an i got the error io.jsonwebtoken.security.SignatureException: JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted. It seems like during decoding - it is not base64 decoding the payload - rather decrypting the signature and extracting the subject from their - Thanks, exactly as you said

[@ianfernandez3258]

Thank you

[@BoualiAli]

You're welcome

[@ElFozter]

Please create a video of how to implement the refresh token, thanks for your work.

[@BoualiAli]

Working on it

[@usounitedsouls2174]

Amazing video ,it was so helpful, My question is why we don't delete the old token instead of setting it expired

[@BoualiAli]

Thank you. You can set a bash script to cleanup the database every period of time.

[@khalilbouali3480]

thanks a lot !

[@BoualiAli]

You're welcome!

[@damian98772]

If someone has a problem with LazyInitializationException occuring, in my case it was because i had @Data annotation in both User and Token Entities, that annotation contains @ToString which caused an infinite loop, I just replaced it with @Getter and @Setter.

[@BoualiAli]

Really thank you for sharing. Keep this great mindset

[@anirudh514]

You saved several hours of time for me. Thank you very much for this suggestion which is hard to notice!!!