Once a user logs in with their username and password, they receive an access_token containing the payload that includes their uniqueTokenIdentifier. This unique identifier is stored for each user in the database.
If a user changes their password due to account hacking or any other reason, the password is updated in the database along with a new uniqueTokenIdentifier. As a result, any requests made using the old access token with the old uniqueTokenIdentifier will not return data related to that user. For instance, the user's messages won't be accessible as the uniqueTokenIdentifier has been changed.
Furthermore, attempting to make requests with the old access_token will trigger a 403 forbidden error since no user with the old uniqueTokenIdentifier exists in the database anymore.
This approach is designed to address situations where an account is compromised, prompting the user to change their password for security purposes. While exploring various solutions to this issue, I came across a method known as token blacklist, which keeps track of revoked tokens. However, I haven't found any information regarding the method outlined above. Are there any potential concerns or security risks associated with this solution that I may be overlooking? Your insights would be appreciated. Thank you.