So you need to maintain state whenever tokens get invalidated, and check this state on every token-bearing request. At that point why not just fetch the rest of

So you need to maintain state whenever tokens get invalidated, and check this state on every token-bearing request. At that point why not just fetch the rest of your session data out of your database? And if it’s some kind of global cutoff - well, now every revoked session comes with a log off for every user, which is a usability nightmare.