[Johnie]

Can't you maintain session state in a Redis daemon and invalidate it there? Or are you talking about stateless JWT?