Comment by amand33p

Yes, they can logout.

Sadly, JWT can be stolen, because my app stores them in local storage. It's a portfolio project, so I didn't use safer methods like cookies.