Does adding immediate logout and refresh token rotation make JWT auth basically session auth?
I'm planning JWT authentication with refresh token rotation, reuse detection, and logout for individual devices. If immediate logout means checking server-side state on every request, is this effectively…