> and expiring it when you log-out?

and how would you do that if the user doesn't actively log out of a service?

set the cookie in the response to their next request to you?

specifics depend upon the language and framework used on the server, etc...

Do you mean "delete the cookie" with "expiring it"? Then that doesn't help against an attacker which already has obtained the JWT, they can still use the JWT until it's expiry.

what i propose: 1) login = sending username and hashed password (over tls) that does a bcrypt etc, compares to bcrypted etc hash in db, if correct = provide a jwt set as a cookie with "secure httpOnly", jwt should be logged.

2) logout = request to server, server sets cookie with "token=empty;expires:1970yaddayadda" as it's httpOnly there's no client-side messing baout with the cookie otherwise

3)_all pages send cookie with each request, so must be tls

upon logout, cookie has empty token, must be re-set with new token. old token, if stolen, can be compared with logged history, etc.

what do you see, in terms of flaws?

so, what about a single-use token you exchange for another token (or not)?