As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless.
Suppose I store
user_id in JWT token and use it to validate users on server, how would a user actually log out?
Just deleting token from browser won't be useful, for example, suppose you want to log out of all other sessions.
Since JWTs are stateless, there can be no way to invalidate existing tokens, solutions could be to keep it in DB which defeats the purpose of JWT.
This would be a major security risk as log out is a very important feature, If JWTs aren't useful as session tokens, what is the perfect use case for JWT?