Token Invalidation

[sam-lippert]

From @nathanclevenger:

We would need to create a list of invalidated token IDs ... and for performance we wouldn't want to wait for those to come through, although they could be in a env variable or fetched after validation (so potentially the initial request of a given worker could be allowed as to not have to await the result list).

From https://blog.indrek.io/articles/invalidate-jwt/:

When the server receives a logout request, take the JWT from the request and store it in an in-memory database. For each authenticated request you would need to check your in-memory database to see if the token has been invalidated. To keep the search space small, you could remove tokens from the blacklist which have already expired.

[sam-lippert]

• /logout adds token to invalidated list with TTL
• Retrieve invalidated token list asynchronously