I Thought JWTs Were Stateless. Turns Out Logout Made Me Build a Stateful Layer Anyway.

This is Part 3 of a 4-part series on building AuthShield - a production-ready standalone authentication microservice. This post covers JWT design, the logout problem, Redis blacklisting, the two-token strategy, and refresh token rotation with reuse detection. Why I Stopped Writing Auth Code for Ever