Signing out a token that cannot be recalled

• A

  Delete the cookie on the client, which signs the user out immediately

• B

  It stays valid until it expires; immediate revocation needs server state

• C

  Rotate the signing key, which invalidates the token straight away

• D

  Add the user to a denylist carried inside the token itself