title: Is it safe to invalidate a JWT using a blacklist cache?
body: <p>The most prevalent examples I have found (as well as code within the JWT-Auth library) provide mechanisms for invalidating JWTs via a black list. If a token needs to be invalidated, it is added to a blacklist, which is essentially just a cache that is subject to volatility. </p>
  
  <p>My concern with my application is that if an attacker received someone's JWT, that if the server were to be forced to restart (or any other circumstance that caused the cache to be wiped) that the JWT would not be invalidated and the attacker could use a previously invalidated token (as unlikely as that may be). I am currently deciding on implementing reference tokens, that way a JWT can be invalidated manually, but it's likely that an attacker has already done their damage by the time you realize it and invalidate your token.</p>
  
  <p>Is it implied that the token will have a life time that is short enough to justify invalidating it based on a cache (that <em>could be</em> cleared/wiped/lost)?</p>