[oautholaf]

In my experience, a working strategy for handling signout or revocation for statically verifyable tokens like JWT is straightforward:

- Clear client side state where you can. - Write signed out/expired tokens to something with a cheap heavy read/eventual consistency model - Fail to signed in if unavailable - Acknowledge that you are gaining latency/availability/ lower costs by trading some precision

I am aware of a very large website most folks use every day that did this for more than a decade and it worked fine.

[jdthedisciple]

great idea! I'm using JWT in one of my projects and still unsure how to fix the irrevocability of JWT while keeping them stateless. But this seems like a nice intermediate solution