The 30 second answer
A self-contained JWT stays valid until its exp claim. Resource servers verify the signature locally and do not know about logout, so a stolen token still works. Mitigations are short-lived access tokens plus refresh tokens revoked on logout, a denylist of jti until expiry, opaque tokens with introspection, or a per-user token version check. Deleting the token only on the client is not revocation.
A self-contained JWT stays **valid until exp** — resource servers verify the signature locally and don't know about logout, so a stolen token still works. Mitigations: short access-token lifetime + refresh tokens that are revoked on logout (RFC 7009), a denylist of jti checked until exp (reintroduces state, use Redis with TTL), opaque tokens + introspection (RFC 7662), or token-version/"issued-after" check per user. Client-side deletion alone is not revocation.
Sources: