Main drawback of stateless JWT access tokens?
Options
- They are too large to send
- They are hard to revoke before expiry (Correct option)
- They require a database lookup on every request
- They only work with OAuth
Answer
They are hard to revoke before expiry
Why
The server validates a JWT just by checking its signature and expiry, without looking anything up. That is fast, but it also means the server cannot easily 'cancel' a token: it stays valid until it expires.
Common solutions: short-lived access tokens (5-15 minutes) plus refresh tokens that CAN be revoked, or a denylist of revoked token IDs.
Remember
JWTs are hard to revoke → keep them short-lived.