title: Spring Security oauth2 with jwt, revocation of refresh token
body: <p>I currently have an implementation of spring security with oauth2 running on spring boot. It is working as expected, and I have set the validity of access tokens to 10 minutes and refresh tokens to 30 days.</p>
  
  <p>However, I would like to be able to invalidate the refresh token if a user has lost a device and wants that client to be logged out.</p>
  
  <p>My token store looks as following:</p>
  
  <pre><code>@Bean
  public JwtAccessTokenConverter jwtAccessTokenConverter() {
      final JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
      jwtAcccessTokenConverter.setSigningKey(this.secret);
      return jwtAcccessTokenConverter;
  }
  
  @Bean
  public TokenStore tokenStore(){
      return new JwtTokenStore(jwtAccessTokenConverter());
  }
  </code></pre>
  
  <p>After looking on the JwtTokenStore class the storeRefreshToken and storeAccessToken methods are blank as expected since the tokens are signed they don't have to be stored.</p>
  
  <p>My plan was to store the generated refresh tokens in a database and then include this as a requirement for the refresh token to be valid.</p>
  
  <p>I've been looking at the JwtTokenStore class and it looks like it can have an optional ApprovalStore.
  Is this the right direction to go to solve this problem?</p>