Assuming that the JWT only stores the user_id, and you then load the full user (protecting against stale data), a counter or a timestamp on the user object can

Assuming that the JWT only stores the user_id, and you then load the full user (protecting against stale data), a counter or a timestamp on the user object can be used to control logout. There's a good Go library detailing this approach, along with a blog post: https://github.com/endiangroup/compandauth https://github.com/endiangroup/compandauth https://endian.io/articles/compandauth/ https://endian.io/articles/compandauth/