CodeParkYou can't delete a stateless JWT. It stays valid until its exp (expiry time), whatever the server does. In practice you combine several measures:
- Short-lived access tokens. Keep them valid for about 5 to 15 minutes. Then a stolen token only works for a short time.
- A server-tracked refresh token. Keep the long-lived credential in a refresh token that the server stores. At logout, the server revokes the refresh token, so no new access tokens can be issued.
- A denylist for instant revocation. Keep a list of blocked token ids (
jti). Or keep a per-user timestamp that means "tokens issued before this time are invalid". Check it on every request. Each entry can expire when its tokens would have expired anyway.
The client also deletes its tokens. But that alone is not revocation, because a copied token still works.
Rotating the signing key revokes every token at once. Use it only in emergencies.
- JWTs can't be deleted, and they stay valid until exp.
- Short-lived access tokens limit how long a stolen token works.
- At logout, revoke the refresh token that the server tracks.
- For instant revocation, use a jti denylist or a per-user issued-before timestamp.
- Clearing the client's storage alone is not revocation.
Read more