Web Security · Middle · Question 43 of 75
Why are JWTs harder to revoke than server-side sessions?
- ✓Correct answer: They're validated without a database lookup, so a stolen token keeps working until it expires unless you add a blocklist
- 2Because JWTs can't have an expiry date
- 3Because JWTs are stored only in the browser history
Explanation
Common fixes are short-lived access tokens with refresh tokens, a token version per user, or a denylist checked on sensitive actions.