> That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token n

> That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem. No you don't, as stated you can refresh your token before it expires. > You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format. I think you can validate the authenticity of your JWT without having to go to a database. This is much more secure than local storage or even a plain old cookie. JWT provides a useful set of features and just because in your opinion it isn't useful plenty of people disagree with your points.