What is the biggest drawback of JWT?

Question

Accepted Answer

JWTs are stateless by design: the server does not store session information. While this improves scalability, it creates a critical revocation problem. Unlike traditional session cookies that can be instantly invalidated by deleting a server-side record, a JWT cannot be revoked without additional infrastructure (e.g., a token blacklist or a short expiration time). If a JWT is stolen, an attacker can use it until it expires, and if the user logs out, the token remains active. This forces developers to either accept the risk, use very short expiration times (which require frequent refreshes), or implement a stateful revocation store — undermining the stateless advantage. // 1. Short expiration + refresh tokens (e.g., 15 min access + 7 day refresh)
// Revocation still not immediate; refresh tokens can be revoked.

// 2. Blacklist (stateful)
const tokenBlacklist = new Set();
function revokeToken(token) { tokenBlacklist.add(token); }
function isRevoked(token) { return tokenBlacklist.has(token); }
// This requires shared storage across servers, losing statelessness.

// 3. Database timestamp for user version
// Store a `token_version` in user record; include version in JWT claim.
// Increment version on logout → all older tokens invalid.
// Still requires database check per request.
``` Token size: JWTs contain header, payload, and signature; they are typically larger than session IDs, increasing bandwidth usage. Information leakage: JWT payload is base64url-encoded, not encrypted (unless using JWE). Sensitive data should never be stored in a JWT. Algorithm confusion attacks: Misconfigured servers accepting 'none' algorithm or type confusion (RS256 vs HS256) can lead to token forgery. Clock skew issues: Expiration validation relies on correct server and client time synchronization. Limited payload size: JWTs are often transmitted in HTTP headers, which have size limits (e.g., 8KB for many servers). Despite these drawbacks, JWTs are widely used for short-lived access tokens in OAuth2/OIDC flows where revocation is handled via refresh token rotation and short expiration (e.g., 5–15 minutes). For long-lived sessions requiring immediate logout, traditional server-side sessions or token blacklists are more appropriate.

What is the biggest drawback of JWT?

The biggest drawback of JWT is the lack of built-in, efficient revocation — once a valid token is issued, it remains valid until its expiration time, even if the user logs out or their permissions change.

Scenario Questions

Follow-up Questions