Implement Session Revocation and JWT Blacklisting in Redis
- Category: Backend: Web3 Auth & Stellar Signatures
- Task ID: BE-W3A-101
Description
This issue covers the implementation, optimization, and security auditing of the Web3 challenge-response authentication suite for 'Implement Session Revocation and JWT Blacklisting in Redis' in backend/src/routes/auth.rs. Stateless JWT tokens present a security risk if a user's session needs to be terminated instantly (e.g. upon user logout or active security breach). We need to implement a Redis-backed session revocation and token blacklisting mechanism. When a user requests a logout or a session is flagged, the JWT must be recorded in Redis with a Time-To-Live (TTL) matching the token's remaining validity, blocking any subsequent request.
Requirements
- Implement signature validation and session routing inside
backend/src/routes/auth.rs for Implement Session Revocation and JWT Blacklisting in Redis.
- Decode and validate Stellar public addresses securely, checking checksum bytes using dynamic decoders.
- Integrate Redis client helpers or secure cookies parameters inside the Axum route state.
- Write comprehensive test mockups to verify signature validations and challenge timelines.
Acceptance Criteria
- Login succeeds with Freighter wallet signatures that conform to SEP-53 standard.
- Incorrect signatures or expired challenges are rejected with a strict 401 Unauthorized status.
- Redis blacklist lookups execute within 1ms and effectively block revoked sessions.
Implement Session Revocation and JWT Blacklisting in Redis
Description
This issue covers the implementation, optimization, and security auditing of the Web3 challenge-response authentication suite for 'Implement Session Revocation and JWT Blacklisting in Redis' in
backend/src/routes/auth.rs. Stateless JWT tokens present a security risk if a user's session needs to be terminated instantly (e.g. upon user logout or active security breach). We need to implement a Redis-backed session revocation and token blacklisting mechanism. When a user requests a logout or a session is flagged, the JWT must be recorded in Redis with a Time-To-Live (TTL) matching the token's remaining validity, blocking any subsequent request.Requirements
backend/src/routes/auth.rsfor Implement Session Revocation and JWT Blacklisting in Redis.Acceptance Criteria