[acaloiar]

> A problem is that a user can't revoke a JWT by logging out or changing their password (unless you build extra infra to store the invalidations and fail closed)

Applications should both invalidate JWTs on logout and validate JWTs haven't been revoked for every request. Yes, it's performance overhead and increases infrastructure demands.

The problem is that people want JWTs to be both secure and fast. But the reality is they can only have one of these qualities at a time. They can sacrifice a bit of speed and get security, or sacrifice a bit of security for speed.

[klodolph]

You can trade for complexity—you can use revocation lists if you want to revoke JWTs. The revocation list of unexpired but revoked JWTs will generally be much shorter than the list of valid JWTs. You can push these lists to your front-ends, if that’s where you authenticate requests.

Far from trivial to implement, but it gives you some amount of performance and security at the same time.