Dual JWT Authentication: Security, Redis, and Trade-Offs

JSTools.Space describes a Dual JWT design: access tokens of 5–15 minutes kept in memory, refresh tokens of up to 30 days in HttpOnly cookies, and a per-user Redis revocation cutoff that invalidates all older refresh tokens at once. The article stresses the trade-offs. Renewing without invalidating old tokens is not replay-resistant rotation, which RFC 9700 expects of public clients. The cutoff cannot end a single device's session, and access tokens may work about five minutes after logout-all. The performance savings are asserted, not measured.