> You need to implement expiring tokens that are refreshed, otherwise there’s no way to revoke a token.

I create a new token for each request. Store expiry time and ephemeral id in the token and the cookie, set a separate ephemeral session cookie. Then on the server side check the expiry time and then cross-check the id stored in the token to the one in the session cookie. And then in response to the request generate a new token with a new id and expiry time.

> check the DB to see if the session is still valid

I am trying to build a stateless server. But I am trying to understand the advantages and disadvantages of stateless and stateful way of managing web sessions.