Considering I have JWT-based web application, which does not check JWT against some database (which would, to my understanding, made JWT usage void since any random string would make the same). The JWT timeout is long enough, so that it will last at least a few minutes after I 'logout'.
How safe is my web application then? If someone get the token, they will still, for a few minutes, be able to work as they were me. The local storage was purged. The browser debugger was inactive or was purged. Is there any other place anyone can access where the token could be read?