I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am trying to solve
The first one is related to the validity of JWT. When the user logs in the application, the app generate a Refresh and an Access token in order to be used by the user. As per the JWT documentation, you can encode the expiration date inside the token, so you can know whenever the token is valid or not.
But what if you want to invalidate a list of JWTs? In case you want to invalidate all JWTs then you can update your secret if I understand correctly.