title: Is JWT in URI a bad practice?
body: <p>I have a backlist of tokens (JWT) stored in Redis and would like to enable users of my website to blacklist their tokens in a RESTful way.</p>
  
  <p>I can either:</p>
  
  <ol>
  <li>Build the route <code>/sessions/&lt;token&gt;</code> with a DELETE method</li>
  <li>Build the route <code>/sessions/</code> with a DELETE method and the token sent in the request body.</li>
  </ol>
  
  <p>The first solution is simple but the token is stored in the server's logs and in the user's browser's history.</p>
  
  <p>The second solution seems better but I'm not sure I'm not breaking HTTP RFC's idempotency principle by sending a DELETE request with a body.</p>
  
  <p>What's the best practice in this case?</p>