Implementing JWT Authentication?

Question

JSON Web Token

I'm trying to implement JWT authentication and I have a few questions. To delog, you need to create a blacklist with a list of non-valid refresh tokens, do I understand correctly that, in theory, you will also need to store a list of revoked access tokens, while they are valid, tk. to ensure instant logout on all devices, will it be necessary to deny access to them as well? Am I correct or not?

Answer 1

You just came up with a reference token. Better implement it right away. Because in the implementation you provided, jwt is more harmful than useful.