There’s nothing really stopping you from revoking a JWT individually - simply keep the `jti` (or any arbitrary claim) in memcached/redis/etc and check it. Obviously it’s no longer stateless and gives up some of the benefits of a JWT, but it’s a solution if revocation is a business requirement.
Like everything, there’s no silver bullet (JWT vs random string token) - business requirements dictate which makes sense.
