Invalidate session for user in authentication

when user login in my web application (Article Website) I'm using Redis to cache the refresh token. So when user login I will generate refresh token and send it to him. While caching in my Redis the user id as key with same id as value something like this redis.set( `refresh:${user.dataValues.id}`, user.dataValues.id, "EX", +process.env.REFRESH_TOKEN_LIFE_TIME ); but for future when may I need to add multidevice sessions that will not be great so I generated a Json Token Id which is UUID V4 and store it in token payload. it will be something like this const jti = crypto.randomUUID(); redis.set( `refresh:${jti}`, user.dataValues.id, // It will be more info in the future "EX", +process.env.REFRESH_TOKEN_LIFE_TIME ); and when user request for another access token I rotate the refresh token and change the JTI. in short update my session but I have a small issue here. When user change his password I want to invalidate all sessions for him there is no way to invalidate all sessions except scanning all the values in my Redis and I thought of adding the user id with the jti in the key and search using matching keys but the docs say it's not great for production due to many things like performance. and I'm thinking to cache the user id and all JTIs he had using either set in Redis or other way and when I want to invalidate the sessions I just get that value from user id and then get all JTIs from Redis and clear them. the question should I store the JTIs array ? or consider use table in database for auth like Auth.js ?

Jun 15, 2025 - 01:20

when user login in my web application (Article Website) I'm using Redis to cache the refresh token. So when user login I will generate refresh token and send it to him. While caching in my Redis the user id as key with same id as value something like this

redis.set(
    `refresh:${user.dataValues.id}`,
    user.dataValues.id,
    "EX",
    +process.env.REFRESH_TOKEN_LIFE_TIME
);

but for future when may I need to add multidevice sessions that will not be great so I generated a Json Token Id which is UUID V4 and store it in token payload. it will be something like this

const jti = crypto.randomUUID();
redis.set(
    `refresh:${jti}`,
    user.dataValues.id, // It will be more info in the future
    "EX",
    +process.env.REFRESH_TOKEN_LIFE_TIME
);

and when user request for another access token I rotate the refresh token and change the JTI. in short update my session

but I have a small issue here. When user change his password I want to invalidate all sessions for him there is no way to invalidate all sessions except scanning all the values in my Redis and I thought of adding the user id with the jti in the key and search using matching keys but the docs say it's not great for production due to many things like performance. and I'm thinking to cache the user id and all JTIs he had using either set in Redis or other way and when I want to invalidate the sessions I just get that value from user id and then get all JTIs from Redis and clear them.

the question should I store the JTIs array ? or consider use table in database for auth like Auth.js ?