Registry / security / jsonwebtoken-redis

jsonwebtoken-redis

JSON →
library1.0.6jsnpmunverified

jsonwebtoken-redis wraps the popular jsonwebtoken library to add Redis-backed token expiration, invalidation, and refresh capabilities. Token expiration is managed entirely by Redis keys, allowing you to invalidate tokens by removing the key, or postpone expiration via the touch command. Unlike the base jsonwebtoken library, all methods return Promises (no callbacks) and require a Redis client. Version 1.0.6 is the latest stable release, with no release cadence documented. Key differentiators: Redis-managed TTL, token destroy/touch, automatic jti generation via uuid.

securitydatabase
npm install jsonwebtoken-redis
github ↗package ↗homepage ↗
INSTALL
IMPORT
SIG · JSONWEBTOKEN-REDIS
J
jsonwebtoken-redis
securityjavascriptv1.0.6
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

default
✓ const JwtRedis = require('jsonwebtoken-redis');
✗ import JwtRedis from 'jsonwebtoken-redis';
The library does not ship ES module exports. Use require() or a dynamic import with default export.
JwtRedis
✓ const JwtRedis = require('jsonwebtoken-redis'); const jwtRedis = new JwtRedis(client, options);
✗ const jwtRedis = require('jsonwebtoken-redis');
Instantiate with new. The exported default is a constructor.
sign
✓ jwtRedis.sign(payload, secret, options).then(...);
✗ JwtRedis.sign(payload, secret, options).then(...);
sign is an instance method, not static. Must be called on a JwtRedis instance.

Demonstrates full lifecycle: sign, verify, touch (extend TTL), and destroy (invalidate) a JWT using Redis-backed expiration.

const redis = require('redis'); const client = redis.createClient({ url: process.env.REDIS_URL ?? 'redis://localhost:6379' }); await client.connect(); const JwtRedis = require('jsonwebtoken-redis'); const jwtRedis = new JwtRedis(client, { prefix: 'session:', expiresKeyIn: '24 hours', promiseImpl: Promise }); const secret = process.env.JWT_SECRET ?? 'shhhhhh'; const payload = { scope: 'user', userId: '1' }; try { const token = await jwtRedis.sign(payload, secret, { expiresKeyIn: '1 hour' }); console.log('Token:', token); const decoded = await jwtRedis.verify(token, secret); console.log('Verified:', decoded); await jwtRedis.touch(token); console.log('Token touched'); await jwtRedis.destroy(token); console.log('Token destroyed'); } catch (err) { console.error(err); } finally { await client.quit(); }
Debug
Known issues
gotchaIf you use expiresIn or exp claim in the payload, the Redis key expiration is based on that JWT expiration, and touch() will NOT work because the token itself expires before Redis key can be extended.
fix
Use only expiresKeyIn option in sign() to allow Redis-managed TTL and enable touch().
affects: >=0.0.0
gotchaThe library does not export ES modules. Using import JwtRedis from 'jsonwebtoken-redis' will fail in Node.js with ESM.
fix
Use CommonJS require() or dynamic import with default export.
affects: >=0.0.0
gotchaAll token operations require Redis client to be connected. verify() will throw if Redis is down, even if the token is valid and not expired.
fix
Ensure Redis client is connected before using jwtRedis methods. Handle connection errors.
affects: >=0.0.0
deprecatedThe library relies on jsonwebtoken for JWT operations, which may have breaking changes or security advisories. Always audit jsonwebtoken updates.
fix
Monitor jsonwebtoken changelog and update jsonwebtoken-redis accordingly (it may lag behind).
affects: >=0.0.0
Errors
Common errors & fixes
TypeError: jwtRedis.sign is not a function
Using static method on the constructor instead of an instance.
fix
const jwtRedis = new JwtRedis(client, options);
jwtRedis.sign(payload, secret, options);
Error: jwtRedis.verify is not a function
Importing as default then calling as static, or not constructing instance.
fix
Instantiate with new JwtRedis(client, options) before calling instance methods.
Error: The client must be connected before using this method
Redis client not connected when calling jwtRedis methods.
fix
await client.connect(); before using jwtRedis.
Error: secretOrPrivateKey must have a value
Passing undefined or empty secret to sign/verify.
fix
Ensure secret is a non-empty string. Use process.env.JWT_SECRET ?? 'fallback'.
Upgrade
Version history
1.0.6latest on npm
Audit
Dependencies
jsonwebtokenrequiredCore JWT signing, verification, and decoding. jsonwebtoken-redis delegates actual JWT operations to this library.
redisrequiredRequired Redis client (e.g., redis or ioredis) to store and manage token keys.
uuidrequiredGenerates random jti (JWT ID) when not provided in payload. Used to create unique Redis keys.
Agent activity
13 hits · last 30 days
node
12
Resources
githubgit://github.com/ayrolabs/jsonwebtoken-redis ↗
packagejsonwebtoken-redis ↗
homepagehttps://ayro.io ↗
jsonwebtoken-redis — npm install jsonwebtoken-redis · libregistry