The compromise everyone actually ships

The compromise everyone actually shipsshort access + long refresh

Production auth rarely picks a pure side. The standard pattern: a short-lived access JWT (5 to 15 minutes) for the hot path, a long-lived refresh token (days to weeks) held more carefully and a revocation check that runs only at refresh time.

1. 1Issue. On login, mint an access JWT (~10 min) plus a refresh token tied to a server record.
2. 2Serve. Verify the access JWT locally on every request. No DB hit, which is the throughput win.
3. 3Refresh. When it expires, the client trades the refresh token for a new access JWT; this is the moment you check revocation and a token_version.
4. 4Revoke. Bump the user's token_version or delete the refresh record; within one access-token TTL, all their tokens stop refreshing.

That token_version (or session_epoch) column is the trick that buys you near-instant revocation without paying for a lookup on every request. You accept a bounded staleness window equal to the access-token lifetime. Make it short and that window is minutes, not days.