{"action":"closed","issue":{"url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/700","repository_url":"https://api.github.com/repos/tymondesigns/jwt-auth","labels_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/700/labels{/name}","comments_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/700/comments","events_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/700/events","html_url":"https://github.com/tymondesigns/jwt-auth/issues/700","id":152591469,"number":700,"title":"Invalid tokens with refresh middleware and parallel requests","user":{"login":"andrewhl","id":1120082,"avatar_url":"https://avatars.githubusercontent.com/u/1120082?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewhl","html_url":"https://github.com/andrewhl","followers_url":"https://api.github.com/users/andrewhl/followers","following_url":"https://api.github.com/users/andrewhl/following{/other_user}","gists_url":"https://api.github.com/users/andrewhl/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewhl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewhl/subscriptions","organizations_url":"https://api.github.com/users/andrewhl/orgs","repos_url":"https://api.github.com/users/andrewhl/repos","events_url":"https://api.github.com/users/andrewhl/events{/privacy}","received_events_url":"https://api.github.com/users/andrewhl/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-02T16:39:12Z","updated_at":"2016-05-05T21:49:29Z","closed_at":"2016-05-05T21:49:29Z","body":"I have the following situation:\r\n\r\n1. GET /profile with valid JWT Bearer token\r\n2. GET /otherEndpoint with same JWT Bearer token\r\n3. Request 1. goes through jwt.refresh middleware\r\n4. Old token is blacklisted\r\n5. Request 2. goes through jwt.refresh middleware\r\n6. Old token is invalid, return response 401 unauthorized for request 2\r\n7. Return response 200 OK for request 1\r\n8. Browser receives new token from response to request 1, after request 2 has been issued\r\n\r\nHow can I resolve this issue? I think I need a 30 second delay before a token is blacklisted. It is not possible to queue the client requests because the application often makes requests in parallel. I have attempted to create a client side middleware of sorts that retries, a finite number of times, 401 token invalid requests. But this still is prone to failure, particularly if a given request takes a long time to return from the server. It is still subject to latency problems.\r\n\r\nAny suggestions would be welcome."}}