That's already done. The problem is that apart from expiration, the token is never invalidated, for example when the user logs out. An attacker who stole the J

That's already done. The problem is that apart from expiration, the token is never invalidated, for example when the user logs out. An attacker who stole the JWT is still logged into the victim's account until expiration.