Web Security · Senior · Question 38 of 75

How should "log out everywhere" be implemented with JWT access tokens?

✓Correct answer: Revoke the refresh tokens and bump a per-user token version or session ID that APIs check, accepting a short delay for access tokens
2Change the user's email address
3Tell the user to clear their browser cache

Explanation

Stateless tokens can't be recalled; the design either checks some state or relies on short access token lifetimes.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.