0

I want to create a jwt blacklist for everytime the user want to refresh the current one, (pratically there is also a fronted call to call this method every tot), My question is i want this blacklist is running for all the thread so for each user(I using wildfly).

My code is this:

This when a jwt is created:

@Component
public class JwtTokenUtil{
private List<String> blackList = new ArrayList<>();
public String getUsernameFromToken(String token) {

        String username;

        try {
            if (token != null) {
                String invalidToken;
                synchronized (blackList) {
                    blackList.removeIf(tokn -> isTokenExpired(tokn));
                    invalidToken = blackList.stream().filter(blackList -> blackList.equals(token)).collect(Collectors.joining());
                    if (!StringUtils.isEmpty(invalidToken)) {
                        throw new RuntimeException("JWT is invalid");
                    }
                }
                final Claims claims = getClaimsFromToken(token);
                username = claims.getSubject();
            } .....

this when it refresh (I get nullpointerException on blackList)

public Boolean canTokenBeRefreshed(String token) {
        if (!isTokenExpired(token)) {
            synchronized (blackList) { <-NullPointerException
                blackList.removeIf(tokn -> isTokenExpired(tokn));
                blackList.add(token);
            }
        }
        return (!isTokenExpired(token));
    }

Both method are in the same class, but i don't know if this is a right way to do it and why i keep getting nullPointerException

Alex
  • 85
  • 6
  • Given the current code `blackList` cannot be `null`, therefore *something* else is going on. And why do you want to blacklist JWTs in the first place, that defeats a large part of their purpose!? – luk2302 Apr 27 '23 at 13:28
  • @luk2302 I need to invalidate the jwt once i create a new one, do you know another way to do that? – Alex Apr 27 '23 at 13:30
  • You generally do **not** need to do that, no. As I said: that defeats e.g. the purpose of a JWT being self contained. – luk2302 Apr 27 '23 at 16:35

0 Answers0