I absolutely agree. That’s why I said: > you could live with the possibility that tokens are valid for some period of time after logout because it usually does

I absolutely agree. That’s why I said: > you could live with the possibility that tokens are valid for some period of time after logout because it usually doesn’t matter - generally you delete the cookie and the user is logged out, even if technically they could restore the cookie later. They won’t, unless you’re under attack.