title: What is the difference between a blacklist of JWT's and sessions?
body: <p>Implementing a login flow and have been persuaded by JWT's because we have scaling as priority.
  In the past, the system would be based on session tokens in a monolith application.  JWT's mean we don't need to have a caching server for user sessions anymore apparently.  So then here's where I am confused:</p>
  <p>If I get round the issue of revocation and token stealing by keeping a blacklist of keys (is the suggestion) then that now looks from above exactly the same thing as session tokens, because I'm doing a lookup with every request.</p>
  <p>Perhaps I am not fully appreciating something or thinking of this wrong.
  Perhaps - the result of not finding the blocked JWT is faster than a full retrieval.</p>
  <p>Thanks for anything that would clear this up :)</p>