# Session token previously blacklisted on refresh **URL:** \ **Category:** Authentication & Security\ **Created:** [December 8, 2016, 12:55pm UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498 "2016-12-08T12:55:05Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rbarriuso](https://avatars.discourse-cdn.com/v4/letter/r/e99b99/32.png) [@rbarriuso](https://community.dreamfactory.com/u/rbarriuso)\ **Post date:** [December 8, 2016, 12:55pm UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498/1 "2016-12-08T12:55:05Z")
Hi, We are using DreamFactory 2.2.0 (Bitnami installer) with the following configuration: - DF\_ALLOW\_FOREVER\_SESSIONS=true - DF\_JWT\_TTL=300 Each time a user opens our client app, the previous session token is automatically refreshed with a PUT request as [explained in the wiki](https://wiki.dreamfactory.com/DreamFactory/Tutorials/Refreshing_a_JWT). Everything works fine most of the time, but it seems that when the client app is used from different devices but with the same user credentials _sometimes_ one of the clients receives the following error from the server when trying to refresh the session token: ```auto {"error":{"context":null,"message":"Thetokenhasbeenblacklisted","code":500,"trace":["0/opt/bitnami/apps/dreamfactory/htdocs/vendor/tymon/jwt-auth/src/JWTManager.php(98):Tymon\\JWTAuth\\JWTManager->decode(Object(Tymon\\JWTAuth\\Token))","1/opt/bitnami/apps/dreamfactory/htdocs/vendor/tymon/jwt-auth/src/JWTAuth.php(144):Tymon\\JWTAuth\\JWTManager->refresh(Object(Tymon\\JWTAuth\\Token))","2/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(6380):Tymon\\JWTAuth\\JWTAuth->refresh('eyJ0eXAiOiJKV1Q...')","3/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Utility/JWTUtilities.php(70):Illuminate\\Support\\Facades\\Facade::__callStatic('refresh',Array)","4/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Utility/JWTUtilities.php(70):Tymon\\JWTAuth\\Facades\\JWTAuth::refresh('eyJ0eXAiOiJKV1Q...')","5/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Resources/UserSessionResource.php(103):DreamFactory\\Core\\Utility\\JWTUtilities::refreshToken()","6[internalfunction]:DreamFactory\\Core\\Resources\\UserSessionResource->handlePUT()","7/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Components/RestHandler.php(267):call_user_func(Array)","8/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Components/RestHandler.php(173):DreamFactory\\Core\\Components\\RestHandler->processRequest()","9/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Components/RestHandler.php(220):DreamFactory\\Core\\Components\\RestHandler->handleRequest(Object(DreamFactory\\Core\\Utility\\ServiceRequest),'')","10/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Components/RestHandler.php(168):DreamFactory\\Core\\Components\\RestHandler->handleResource(Array)","11/opt/bitnami/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Services/BaseRestService.php(74):DreamFactory\\Core\\Components\\RestHandler->handleRequest(Object(DreamFactory\\Core\\Utility\\ServiceRequest),'session')","12/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(17036):DreamFactory\\Core\\Services\\BaseRestService->handleRequest(Object(DreamFactory\\Core\\Utility\\ServiceRequest),'session')","13/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(17012):DreamFactory\\Http\\Controllers\\RestController->handleService('v2','user','session')","14[internalfunction]:DreamFactory\\Http\\Controllers\\RestController->handlePUT('v2','user','session')","15/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9093):call_user_func_array(Array,Array)","16/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9155):Illuminate\\Routing\\Controller->callAction('handlePUT',Array)","17/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9135):Illuminate\\Routing\\ControllerDispatcher->call(Object(DreamFactory\\Http\\Controllers\\RestController),Object(Illuminate\\Routing\\Route),'handlePUT')","18[internalfunction]:Illuminate\\Routing\\ControllerDispatcher->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","19/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(52):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","20/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(17211):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","21[internalfunction]:DreamFactory\\Http\\Middleware\\AccessCheck->handle(Object(Illuminate\\Http\\Request),Object(Closure))","22/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","23[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","24/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","25[internalfunction]:Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","26/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9612):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","27/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9136):Illuminate\\Pipeline\\Pipeline->then(Object(Closure))","28/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9123):Illuminate\\Routing\\ControllerDispatcher->callWithinStack(Object(DreamFactory\\Http\\Controllers\\RestController),Object(Illuminate\\Routing\\Route),Object(Illuminate\\Http\\Request),'handlePUT')","29/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(8191):Illuminate\\Routing\\ControllerDispatcher->dispatch(Object(Illuminate\\Routing\\Route),Object(Illuminate\\Http\\Request),'DreamFactory\\\\Ht...','handlePUT')","30/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(8178):Illuminate\\Routing\\Route->runController(Object(Illuminate\\Http\\Request))","31/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(7892):Illuminate\\Routing\\Route->run(Object(Illuminate\\Http\\Request))","32[internalfunction]:Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","33/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(52):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","34[internalfunction]:Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","35/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9612):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","36/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(7893):Illuminate\\Pipeline\\Pipeline->then(Object(Closure))","37/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(7884):Illuminate\\Routing\\Router->runRouteWithinStack(Object(Illuminate\\Routing\\Route),Object(Illuminate\\Http\\Request))","38/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(7874):Illuminate\\Routing\\Router->dispatchToRoute(Object(Illuminate\\Http\\Request))","39/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(2416):Illuminate\\Routing\\Router->dispatch(Object(Illuminate\\Http\\Request))","40[internalfunction]:Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}(Object(Illuminate\\Http\\Request))","41/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(52):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","42/opt/bitnami/apps/dreamfactory/htdocs/app/Http/Middleware/AuthCheck.php(178):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","43[internalfunction]:DreamFactory\\Http\\Middleware\\AuthCheck->handle(Object(Illuminate\\Http\\Request),Object(Closure))","44/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","45[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","46/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","47/opt/bitnami/apps/dreamfactory/htdocs/vendor/barryvdh/laravel-cors/src/HandleCors.php(42):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","48[internalfunction]:Barryvdh\\Cors\\HandleCors->handle(Object(Illuminate\\Http\\Request),Object(Closure))","49/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","50[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","51/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","52/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(17306):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","53[internalfunction]:DreamFactory\\Http\\Middleware\\FirstUserCheck->handle(Object(Illuminate\\Http\\Request),Object(Closure))","54/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","55[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","56/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","57/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(13076):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","58[internalfunction]:Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle(Object(Illuminate\\Http\\Request),Object(Closure))","59/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","60[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","61/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","62/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(11622):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","63[internalfunction]:Illuminate\\Session\\Middleware\\StartSession->handle(Object(Illuminate\\Http\\Request),Object(Closure))","64/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","65[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","66/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","67/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(12815):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","68[internalfunction]:Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle(Object(Illuminate\\Http\\Request),Object(Closure))","69/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","70[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","71/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","72/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(12752):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","73[internalfunction]:Illuminate\\Cookie\\Middleware\\EncryptCookies->handle(Object(Illuminate\\Http\\Request),Object(Closure))","74/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","75[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","76/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","77/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(3271):Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","78[internalfunction]:Illuminate\\Foundation\\Http\\Middleware\\CheckForMaintenanceMode->handle(Object(Illuminate\\Http\\Request),Object(Closure))","79/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9627):call_user_func_array(Array,Array)","80[internalfunction]:Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))","81/opt/bitnami/apps/dreamfactory/htdocs/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(32):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","82[internalfunction]:Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))","83/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(9612):call_user_func(Object(Closure),Object(Illuminate\\Http\\Request))","84/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(2363):Illuminate\\Pipeline\\Pipeline->then(Object(Closure))","85/opt/bitnami/apps/dreamfactory/htdocs/bootstrap/cache/compiled.php(2347):Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter(Object(Illuminate\\Http\\Request))","86/opt/bitnami/apps/dreamfactory/htdocs/public/index.php(53):Illuminate\\Foundation\\Http\\Kernel->handle(Object(Illuminate\\Http\\Request))","87{main}"]}} ``` We’ve checked that the previous session token (which is used for the PUT request) in both clients is not the same at the moment the problem happens, so we ruled out that one of the clients might be blacklisting the other’s session. Is this a known issue in v2.2.0? Has anyone else experienced this problem? Is there a way to track when and why a token has been blacklisted? Thanks in advance. ---
**Author:** ![zerox12](https://avatars.discourse-cdn.com/v4/letter/z/e5b9ba/32.png) [@zerox12](https://community.dreamfactory.com/u/zerox12)\ **Post date:** [December 9, 2016, 2:48am UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498/2 "2016-12-09T02:48:21Z")
I run in to the same problem where sometimes my token is blacklisted even though the time has not expired. I even tested it with a TTL of 130000. The token gets blacklisted even though the session was never deleted (logout). It’s a painful problem because the only solution for the user is to logout (which will also throw errors because of the blacklisted token) and log in again. ---
**Author:** ![rbarriuso](https://avatars.discourse-cdn.com/v4/letter/r/e99b99/32.png) [@rbarriuso](https://community.dreamfactory.com/u/rbarriuso)\ **Post date:** [December 20, 2016, 11:31am UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498/3 "2016-12-20T11:31:59Z")
So do you think this is a bug @benbusse ? ---
**Author:** ![Serkan](https://avatars.discourse-cdn.com/v4/letter/s/b5ac83/32.png) [@Serkan](https://community.dreamfactory.com/u/Serkan)\ **Post date:** [December 23, 2016, 12:47pm UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498/4 "2016-12-23T12:47:58Z")
Hello, I have the same issue. After 60 minutes token is blacklisted. Please @benbusse answer this topic. DreamFactory Version: 2.3.1(Bitnami) ---
**Author:** ![aislam](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/aislam/32/421_2.png) [@aislam](https://community.dreamfactory.com/u/aislam)\ **Post date:** [December 23, 2016, 3:24pm UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498/5 "2016-12-23T15:24:54Z")
The only way you can get the token blacklisted error is if you use a token that was already refreshed or logged out on. Expired token produces token expired error. I am not really sure how your ( @rbarriuso) client app handles JWT. Would there be in any chance your client app is sending a token on the PUT call that was already refreshed or logged out on? If you haven’t seen this already, here is a thread where forever JWT was discussed in great details before… > [@Setting up Permanent Session Token in DF 2.0](https://community.dreamfactory.com/t/setting-up-permanent-session-token-in-df-2-0/1506): > > Hi, As mentioned over multiple posts in the forums that DF 2.0 will support Permanent Session Tokens. I decided to setup the public beta on a local VM. I have been able to install & safely copy my database(s) from 1.9.x to 2.0. However, I feel there is a lack of documentation for 2.0, at the moment. My experience in programming Web technologies is limited, my background being mostly C# WinForms applications. Currently trying out an AngularJS Web Application + DF as a back end for a proof of co… ---
**Author:** ![rbarriuso](https://avatars.discourse-cdn.com/v4/letter/r/e99b99/32.png) [@rbarriuso](https://community.dreamfactory.com/u/rbarriuso)\ **Post date:** [January 3, 2017, 9:10am UTC](https://community.dreamfactory.com/t/session-token-previously-blacklisted-on-refresh/3498/6 "2017-01-03T09:10:28Z")
@aislam No, we’re sure that our client isn’t sending a blacklisted token PUT call. And in spite of it, we still receive the error from time to time. On a different topic, though related: when the time defined by `DF_JWT_REFRESH_TTL` in the `.env` file has passed, is the token considered as blacklisted too?