The revocation problem

JWT Authentication Course · lesson 5 of 13 · 5 min read

Stateless validation is the selling point and the weakness in the same sentence.

Open this lesson in the learning hub

Key points

  • A JWT is validated by maths alone - no database lookup, which is why it scales.
  • But that means the server has no record of it, so it cannot be cancelled before it expires.
  • Log out, change your password, get fired - an issued token keeps working until exp.
  • Mitigations: short expiry, a denylist keyed on jti, or a per-user token version checked on each request.
  • Every mitigation reintroduces state - which is exactly the property JWTs were chosen to avoid.

Stateless validation and instant revocation are mutually exclusive - short expiry is the usual compromise.

The alg:none attack Where to store a token in a browser

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the JWT Authentication Course course, and every lesson in it is listed on the JWT Authentication Course contents page.