JWT without blacklists: invalidate all sessions instantly

In WikiMind, we got rid of the classic JWT pain: we don't carry blacklists around, and we don't have to ask, “Is this token dead already, or still alive?” Instead, we use a unique jwt_secret for each user.

Here's how it works: first, we decode the token without verifying the signature, extract user_uuid, go to the database for that user's personal jwt_secret — and only then validate the signature. If we need to log a user out everywhere, we just change one key. That's it: all old tokens turn into pumpkins. O(1) instead of dealing with blacklists.

For our 1200+ DAU, this is not a “micro-optimization” but solid architectural hygiene. Especially now, when IT is all about security by design: less state, fewer edge cases, and a lower chance of getting surprised on Friday evening.

In short, sometimes one key does more than an entire caffeine-fueled auth service 😅