The recommendation seems to be using an encrypted cookie, with some format other than JWT. Which is fine and well. But how does that take revocation into acco

The recommendation seems to be using an encrypted cookie, with some format other than JWT. Which is fine and well. But how does that take revocation into account? You can store a token on the client side, in ANY format. The problem remains that you're either storing some server-side state about that token, or you aren't. If you are, then you're not really using client-side sessions. If you aren't, then you still don't have a good way to revoke. Because you can't really control the client-side after you've issued a token, and you can't revoke it from the server-side without state. I'm sure there are good arguments to be made against the use of JWT. But their simply aren't any to be found in this thread, and no alternative client-side proposal that solves the revocation problem.