Hacker News Reader

You don't need a DB. The same in memory stuff that supposedly works for fast session auth works here too.

> You won't know which tokens should be considered expired in-advance, you still have to call the DB for every request to check

You can verify the signature before calling the DB.

You can push a list of revoked tokens to each server (similar to how certificate revocation lists work with (m)TLS).