SSO授权：除JWT外是否存在其他角色与权限存储方式？

Hey folks, let's dive into the main drawbacks of using JWT tokens to carry role and permission claims—this is a super common issue when building auth systems, so it's good to unpack these:

Core Drawbacks #

• Bloated Token Size: If you encode a full list of access points (like specific API endpoints a user can access) into the JWT payload, the token gets noticeably larger. Since this token is sent with every single request, that extra payload adds unnecessary overhead, eating into bandwidth and potentially slowing down request processing, especially for apps with granular, per-endpoint permissions.
• Stale Permissions During Token Lifespan: JWTs are valid for their entire configured expiry window (you mentioned 30 minutes here). That means if an admin changes a user's permissions—say, revokes access to a sensitive feature—those changes won't kick in until the user's current token expires and they get a new one. This creates a security gap where unauthorized access is still possible for up to 30 minutes.
• Revoked Tokens Remain Valid: On top of permission delays, if a token is explicitly revoked (like when a user logs out, their account is suspended, or they change their password), the revoked token will still be accepted by your backend until it naturally expires. Since JWTs are stateless by design, there's no built-in way to invalidate them immediately without adding extra checks.

Quick Ways to Mitigate These Issues #

If you're dealing with these problems, here are a few practical fixes:

• Store Permissions in a Database: Instead of stuffing all permissions into the JWT, just include a user ID or role ID in the token. Then, fetch the latest permissions from your database on each request (you can cache frequent permission sets to keep performance snappy).
• Implement a Token Revocation List: Use an in-memory store like Redis to track revoked tokens. On every request, check if the incoming token is in the list—if it is, reject the request automatically. Just remember to clean up expired tokens from the list regularly to avoid wasting space.
• Shorten Access Token Expiry: Reduce the JWT expiry time to something shorter (like 5-10 minutes) and pair it with a longer-lived refresh token. This way, stale permissions or revoked tokens are only valid for a small window, and users get new access tokens automatically via the refresh token without having to re-login.

内容的提问来源于stack exchange，提问作者Avinash Goud