A user clicks Sign out of all devices after a phone theft. Sessions live in Redis and JWTs are validated at the edge. How do you make revocation effective within seconds globally?

AuthSessionsJWTSecurity

How I frame it

Pure JWT-without-server-state cannot be revoked until expiry — unacceptable for theft. Design: short-lived access tokens + revocable server-side session / refresh + a global deny signal that edge caches honor within seconds.

Mechanism

Session store: sessions keyed by user id, or refresh-token families in Redis / DB. Access JWT carries sid + iat / ver.
Logout everywhere: Delete all sessions for user; bump user.token_version (or revoke_before timestamp).
Edge check: On each request, validate JWT signature, then check sid exists OR jwt.ver >= user.ver. Cache deny list / version in edge KV with TTL 1–5s.
Propagation: Pub/sub or global Redis / edge config push so all POPs see new token_version within seconds.
Access token TTL: 5–15 minutes max if you only check version on refresh — tighter if theft SLAs demand sub-minute kill (then version check on every access).

Logout all → token_version 7 → 8; wipe refresh tokens
Stolen phone JWT ver=7 → edge: ver &lt; 8 → 401
New login issues ver=8 tokens

Trade-offs

Version check on every request adds a round-trip (mitigate with edge cache). Opaque server sessions are easier to revoke but heavier. Hybrid is standard: JWT access + opaque refresh + version.

Weak answer

"Blacklist every JWT jti in Redis until exp." Works but list grows with every logout; version bump is cheaper for logout-all. "Wait for JWT to expire (24h)." Fails the theft scenario.

Follow-up questions

Revoke one device only?

Delete that sid / refresh family; leave others. Rotate refresh on use (rotation reuse detection = theft signal).

Offline mobile with long-lived token?

Force short access TTL; secure enclave refresh; remote wipe via push is complementary, not sufficient alone.