Comment by cogman10

JWT is a token, often stored as a cookie. I don't see how it's impossible to invalidate a JWT but easy to invalidate a cookie or token.