Answer
Token revocation strategies:
- Blacklist tokens in database
- Short-lived access tokens
- Rotating refresh tokens
Quick Answer
Token revocation: JWTs are stateless - no built-in revocation. To revoke: maintain a token blocklist in Redis (check on each request, fast lookup). Short-lived tokens reduce the window. Use refresh token rotation - invalidate refresh token on use or logout. For immediate revocation (compromised account): store user's "token issued before" timestamp and reject tokens issued before logout.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ