The problem with blacklisting is that then you end up doing the database hits and avoiding those was one of the reasons for adopting signed tokens. I see the v

The problem with blacklisting is that then you end up doing the database hits and avoiding those was one of the reasons for adopting signed tokens. I see the value of signed tokens in complex infrastructure where you want to have one heavily guarded system doing the authentication and token assignment and then a bunch of other systems just validating the tokens.