Yup I guess checking against the token itself would work

Question

agartha · Answer

But that means storing the tokens itself which would normally be considered a huge security risk

agartha · Answer

You have to treat them at least like passwords so hashing salt pepper oregano the works

florian · Answer

True going bcrypt or I could concatenate the token s `iat` and `userId`

agartha · Answer

But where would you check if a token is blacklisted

agartha · Answer

You said before in a permission query but you don t have the current token in that permission query

florian · Answer

I would check using permissions queries on Models that require auth to be accessed

florian · Answer

Ah

agartha · Answer

How would such a permission query look like `SomeBlacklistTokenExists filter token $whathere `

florian · Answer

I m doomed slightly smiling face

agartha · Answer

You are

agartha · Answer

I wrote this a while ago <https github com graphcool framework issues 137 issuecomment 321384222>

agartha · Answer

That also mentions revoking tokens

florian · Answer

I see thanks love the bit on claims

agartha · Answer

Thanks

florian · Answer

I guess I could check the token in a resolver but that would require to wrap all my private models access confused

agartha · Answer

You can t return model types from resolver functions so that also wouldn t work

agartha · Answer

The only option I can think of is to create an API Gateway with your own JWT tokens with a jti where you can check for revocation and exchange them for Graphcool tokens

Fitch · Answer

Fitch · Answer

Thats what we did a lambda with a bitwise operator that issues jots that map to roles

Fitch · Answer

then a resolver to check mutations for roles