core practice · coding problem
JWT revocation tradeoff
User logs out. Session store vs JWT blacklist vs short TTL+refresh — pick one for banking app, justify.
The mechanism
Authentication proves who you are; authorization decides what you may do. JWTs are stateless and fast but hard to revoke; sessions are revocable but need a store. Pick per the revocation requirement.
Expected evidence
Short-lived JWT + refresh rotation or server session for instant revoke.
Try this drill in the practice workspace →
Hints when you need them
- Stateless JWT cannot revoke without blocklist.
- Sessions need store.
Watch for these mistakes
- Confusing authentication with authorization
- Long-lived JWTs with no revocation strategy
- Trusting client-supplied roles