Yes. If an API checks only a self-contained JWT’s signature and expiration, a token issued to an administrator can remain usable after that account is disabled—until the token expires. Preventing that requires a way for the API to learn that the account, session, or token has been revoked. The incident implied by the headline is not documented by the cited sources, so this article treats it as a design scenario, not a verified event.
Why disabling an account does not invalidate its JWT
A self-contained JSON Web Token carries claims that a resource server can validate locally. The server can verify the signature and check claims such as issuer, audience, and expiration without contacting the issuer on every request. But disabling an account does not alter a copy of a token already held by a client.
As an Amazon Associate I earn from qualifying purchases.
If the token remains correctly signed and has not reached its exp time, local signature-and-expiration checks alone do not reveal the account change. Expiration limits how long a token may be accepted; it is not a signal that an account has been disabled. See RFC 7519 and OWASP’s JSON Web Token Cheat Sheet.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
OWASP ASVS requires applications to terminate active sessions when an account is disabled or deleted. It specifically cautions that self-contained tokens need additional measures to be revoked or blocked, or they may remain valid until expiration. The standard is available in the OWASP Application Security Verification Standard 5.0.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What “dual-mode JWT” can mean in this design
“Dual-mode JWT” is not established here as a standardized JWT feature or protocol mode. A useful description for this design is a two-part validation flow: first perform ordinary local cryptographic and claim validation; then consult current server-side state when policy requires an account or session change to take effect before token expiration.
This keeps the JWT’s local validation useful while adding a revocation control. It also means the request path depends on current state, whether through a database, cache, session service, or token-status service. That dependency—not a special property of JWT itself—is the tradeoff.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Ways to block a token before it expires
| Approach | How it blocks access | Key tradeoff |
|---|---|---|
| Server-side session records | Check whether the session associated with the token remains active; mark it terminated when access should end. | Provides current session state, but requires a shared-state check or an appropriately managed cache on requests that need immediate enforcement. |
| Denylist keyed by token ID | Record a terminated token’s unique jti until it expires; check the denylist during validation. OWASP describes using iss with jti as a typical key, and its REST guidance also discusses aud. |
Requires consistent checks across relevant APIs and storage of entries for the tokens’ remaining lifetimes. |
| Per-user issuance cutoff | Store a user-specific cutoff time and reject that user’s tokens issued before it. | Can invalidate a group of older tokens for that user, but requires current cutoff state and careful handling of issuance times. |
| Per-user signing-key rotation | Change the user-specific key used to validate that user’s tokens, making tokens signed with the prior key unacceptable. | Requires key-management and validation logic that can associate a user’s tokens with the correct current key. |
| Token Status List | Use a token’s status-list location and index to determine whether it remains acceptable. | Adds a status-list distribution and freshness dependency to validation. |
These options are described in OWASP’s JWT guidance and REST Security Cheat Sheet, and in ASVS session-management requirements. The cited guidance does not provide benchmark figures for comparing their speed or operational cost.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the revocation behavior before choosing the mechanism
For a disabled administrator, decide whether the policy requires rejection on the next request or allows a bounded propagation delay. That decision determines whether a cached status is adequate, how often it must be refreshed, and what happens if the status source is unreachable.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Freshness: A cached active status can outlive an account change until the cache is refreshed or invalidated. Set a freshness policy consistent with the required revocation speed.
- Availability: If a database or status service is unavailable, decide explicitly whether affected requests fail closed (deny access) or fail open (continue accepting otherwise-valid tokens). These choices have different security and availability consequences.
- Coverage: Apply the status check to every API that accepts the token. A control enforced by only one service does not invalidate the token at other services that continue local validation.
- Scope: Decide whether disabling an account ends every session, only administrative access, or only a particular token. The chosen state record and invalidation operation should match that policy.
Keep ordinary JWT validation even when revocation is added
A revocation check supplements cryptographic and claim validation; it does not replace it. OWASP’s REST guidance says to select acceptable algorithms from application configuration rather than allowing the token header to choose them, and calls for checking integrity, issuer (iss), audience (aud), and expiration (exp) for access-control JWTs. RFC 8725 says a JWT issued for multiple relying parties or applications must contain an audience claim that can identify the intended recipient.
Use the guidance in the OWASP REST Security Cheat Sheet, RFC 8725, and RFC 7519 together: first establish that the token is authentic and intended for this API, then apply the account, session, or token-status policy.
Rank #4
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
Why OAuth revocation may not reach a locally validating API
OAuth token revocation, defined by RFC 7009, is an authorization-server operation. A resource server that validates a self-contained access token locally may not learn that it was revoked. If it must reject the token before expiration, it needs a way to receive or check that current status, such as shared revocation state or a status/introspection mechanism supported by its design.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTherefore, revoking a token at the authorization server and enforcing that revocation at every resource server are related but distinct steps. The enforcement mechanism and its propagation behavior determine when an API stops accepting the token.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
