> If you really wanted, you'd need to manage a blacklist of tokens on the server and compare every token against that list which would defeat the purpose of JWT

> If you really wanted, you'd need to manage a blacklist of tokens on the server and compare every token against that list which would defeat the purpose of JWT's scalability benefits. The blacklist approach does presumably incur network latency, however, the amount of overhead/space for the blacklist is going to be substantially smaller than the total set of JWTs. Also: the blacklist only needs to be maintained until a blacklisted token naturally expires, further enabling performance. Any number of stores or structures would be suitable for the maintaining the blacklist: Memcached, Redis, even a bloom filter (especially if tokens aren't regularly blacklisted) will suffice. Granted, there are tradeoffs, and at this point, traditional sessions probably make more sense, but it s at least possible. It's much easier to scale recall from a (likely) small blacklist of token IDs + TTLs than all sessions, everywhere.