title: Logout in token-based authentication and Single page application
body: <p>I'm using JWT authentication for my Spring Boot application. The front-end is going to be a single-page-application.</p>
  
  <p>Should I handle logout functionality on the server side? As far as I understand, there's no way to invalidate a JWT token unless we have a stateful server (storing logged out tokens for the maximum lifetime of a token).</p>
  
  <p>The SPA passes the JWT token every time making a request in its header, and it can delete it from the localStorage when the user visits <code>/logout</code> without making a call to the server.</p>
  
  <p>What are the potential issues? Is this idea used anywhere else? What is the best practice?</p>