One idea I thought about was making expiration times quick and adding a counter to the claims, which would increment whenever an expiration time is reached so a new JWT would be given to the client, and when counter would reach 0 (here assuming for example we decrement it), it would invalidate and require another login.
That way, a token could be revoked because tokens would be short-lived, but at the same time it wouldn't require storing refresh keys etc.
MarkAssPandi
@MarkAssPandi@shrimpnet.gej.pet