title: How should/could I store my JWT tokens in redis so that I can see current user sessions?
body: <p>I'm using <strong><em>Java with Spring</em></strong> to build a rest api along with a couple of other services. </p>
  
  <p>The main functionality being the creation/login of users. I know that there isn't a query language in <strong><em>redis</em></strong> which is why I'm posting the question here! Is there some sort of library in Java that allows us to query against <strong><em>Redis</em></strong>? In my case to get all the current <strong><em>jwt</em></strong> tokens (sessions) that are assigned to a user (userId)?</p>
  
  <p>I thought of an implementation by myself but am thinking it's a bit over the top and clunky? </p>
  
  <ol>
  <li>I'd use the <strong><em>userId</em></strong> as the key</li>
  <li>I'd then store a <strong><em>hashmap</em></strong> of <strong><em>JWT</em></strong> tokens inside the value section.</li>
  </ol>
  
  <p>Example</p>
  
  <ol>
  <li>User logs in</li>
  <li>We create JWT</li>
  <li>We create a hashmap and then add the <strong><em>JWT</em></strong></li>
  <li>We'd then assign the hashmap as a byte array to a redis key (userId)</li>
  <li>We'd save the redis key+value</li>
  </ol>
  
  <p>If the same user logs in, I'd have to go through again and do the following: </p>
  
  <ol>
  <li>Create JWT</li>
  <li>Search for existing redis keys with the userId</li>
  <li>We'd then cast the found value to our initial <strong><em>JWT</em></strong> object</li>
  <li>We then add another <strong><em>JWT</em></strong> object to the hashmap</li>
  <li>Save the key+value</li>
  </ol>
  
  <p>This means on each request to protected api endpoints I'd have to search by userId, deserialise the hashmap, loop through the hashmap and try match the JWT that was sent in the header. This seems like a lot of work? Is there another way of doing this?</p>
  
  <p>If a user wanted to log out the process would be very similar to logging in again, except for point <strong><em>4.</em></strong>, I'd delete the JWT from the hashmap and then save it.</p>
  
  <p>At the moment I'm just storing the <strong><em>JWT</em></strong> token as the key and doing a simple <strong><em>jedis.get(RequestHeader.JWT)</em></strong> on protected api endpoints. If there was a way of querying against the value and not the key, then this would be ideal, as I could just store the key as the JWT and the userId as the value.  </p>
  
  <p>Like so:</p>
  
  <pre><code>final String token = authHeader.substring(7); // The part after "Bearer "
   try {
        final Claims claims = Jwts.parser().setSigningKey("${secret}")
             .parseClaimsJws(token).getBody();
              request.setAttribute("claims", claims);
              request.setAttribute("token", token);
   } catch (final SignatureException e)  { throw new ServletException("Invalid token."); }
  
  if (redisClient.get(token) == null) throw new ServletException("Invalid or expired token.");
  </code></pre>