JWT Session Revocation Pack

Deleting a JWT from one browser does not invalidate the signed copy an attacker already has.

A self-contained access token normally remains valid until its expiry. Practical logout therefore uses two layers: short-lived access tokens and server-side refresh sessions that can be revoked.

The session model

Issue an access token with a short lifetime and the smallest useful claims. Keep the refresh session in a database with:

• user, session, and token-family IDs;
• a hash or verifier of the refresh token;
• created, used, and expiry times;
• device or client context useful for the user;
• revoked reason and replacement link.

Rotate the refresh token after every use. In one atomic operation, mark the old token used and create its replacement. If an old token appears again, assume the family was copied and revoke the family. That is refresh-token reuse detection.

Logout paths

Logout this device revokes one refresh session. Logout all devices revokes every refresh session for the account and can also bump a user session version checked by sensitive endpoints. An emergency response may use a deny list or version check for access tokens, but that adds server state and lookup cost.

Be honest about the remaining window. Unless every request checks revocation state, an access token issued just before logout can work until its short expiry. This is why access-token lifetime is a risk decision, not a random library default.

Verification checklist

1. Refresh once and prove the old refresh token no longer works.
2. Reuse that old token and prove the entire token family is revoked.
3. Log out one device and prove a second session still refreshes.
4. Log out all devices and prove every refresh session fails.
5. Test a stolen access token immediately after logout and document the maximum exposure window.
6. Exercise signing-key rotation with old and new keys during the overlap period.
7. Confirm raw refresh tokens never appear in the database, logs, analytics, or fixtures.

The starter accepts your token policy, refresh-session records, logout requirements, stolen-token events, and emergency rules. It returns the session architecture, token lifetimes, rotation contract, reuse detection, revocation paths, and security tests. Dry-run changes no live session.

Download the runnable pack

• Complete workflow pack ZIP
• Importable n8n workflow
• GitHub validation workflow
• GitHub manual run workflow
• Docker Compose file
• Fictional sample payload
• Expected safe dry-run result

Comment TOKEN for the pack. Logout revokes the refresh path; short expiry limits the access token left behind.