> Would this "nonce" in the database? Only in revoked list=1,2,5,7 etc. Unlike storing all sessions, you only store revoked integers which takes way less space

> Would this "nonce" in the database? Only in revoked list=1,2,5,7 etc. Unlike storing all sessions, you only store revoked integers which takes way less space and achieves same revocation you wanted. > That's optimistic Nobody should store > leaving themselves vulnerable to old attacks Every new line of code is probably a vulnerability. That's life. BTW JWT indeed had some super stupid bug with alg=NONE before, and I would simply throw away "header" from JWT