Opinion : JSON web tokens

Interesting. That might be a solution. I would still put an id  in my jwt that eventually tied back to a database sessions table. I know that defeats the purpose of stateless, but God mighty would it simplify native app development.

Yes, you should add identifier for each jwt token. And identifier tie to ip address, device os, etc stored in database. So user can access/track their jwt record then delete the unrecognized jwt. If your secret key is leaked, posibble for attacker to generate jwt, but not the identifier. Identifier should be generate randomly secure. On native mobile app maybe you can expose jwt payload, so user can know their identifier too.

Keep calm.