medium10 pts · first answer countsauthenticationjwtsecurity

Logging out with JWTs

Your API uses stateless JWT access tokens valid for 7 days. A user reports a stolen laptop and you want to log them out immediately. What is the main problem?

A.A signed JWT stays valid until it expires unless you add server-side checks such as a denylist or short expiry with refresh tokensB.JWTs cannot carry a user id, so you do not know whose token it isC.Deleting the user cookie on the server instantly invalidates all copies of the JWTD.JWTs are encrypted, so the server cannot read the expiry time

← Cache-aside pattern Isolation levels and dirty reads →