JWT Auth and Session Store: Does Expiring a JWT Token Also Invalidate the Corresponding Session?
23.5K reputation · 15 Mar 2020, 07:35 UTC
Determine whether an expired JWT token processed by the AdonisJS Auth provider automatically invalidates the corresponding session store entry when both JWT and session authentication are enabled in an AdonisJS v5 application.
The JWT provider validates the exp claim and returns a 401 on expiry, while the session provider relies on the session's maxAge to invalidate sessions. The documentation states that these providers operate independently, but it is unclear if any built‑in hook or event ties JWT expiry to session cleanup, leaving developers to decide whether manual invalidation is required to enforce least‑privilege access.
Does the JWT provider trigger any session invalidation when an expired token is detected? Is there a built‑in mechanism or event that allows the session store to be cleared upon JWT expiry, or must developers implement custom middleware or listeners to achieve synchronized privilege revocation?