I am using express gateway as API Gateway middleware with the following setup.
I have setup the EG config such a way that it verifies the JWT and only passes requests with correct JWT. Because the authorization checkCredentialExistence
on the gateway itself.
When users sends logout request I revoke both access & refresh token from the auth server. BUT, the revoked JWT token still a valid token. And gateway keep passing the incoming requests with revoked jwt.
Is there a way to check with remote api if JWT is still valid in Express gateway?
jwt access token is kind of self signed token and there is no way to revoke it, you can use refrence token for this senario