It seems we're at a (local?) maximum with JWT over cookies + refresh tokens + blacklisting. I'm not sold on refresh tokens being a strict benefit because in th

It seems we're at a (local?) maximum with JWT over cookies + refresh tokens + blacklisting. I'm not sold on refresh tokens being a strict benefit because in the end you still have to maintain state to make sure they can't be used indefinitely. In the end though, opaque tokens are still the easiest and are way simpler to wrap your head around. Allow calls to redis or the auth server itself early on, and if that extra call really becomes a problem, start doing a push model (where the auth server pushes out updates to others) with caches near every service.