I've been implementing an authentication flow for an app that I've been making that uses JWTs. When a user is initially logged in or when they register (which immediately logs them in), I provide an access token and a refresh token. Access token expires every t hours but the refresh token never expires. I want to revoke the tokens when the user logs out.
One approach I've heard is that you can store a list of revoked tokens in a database and set a TTL on the document so that the database doesn't consume too much space.
I've also thought about storing a list of active tokens in a database which is sort of the inverse of this but I've heard people say that this is a bad idea but it seems to me that it is the same as storing revoked tokens.
Why would you choose to store blacklisted tokens over storing active tokens? Both require a database search. Both remove the statelessness of JWTs.