JWT Revocation vs Session Cookie Revocation in .NET for Least-Privilege Authentication

Balancing Immediate Credential Revocation Against Performance in .NET Authentication

When implementing least-privilege authentication in .NET, a key architectural decision involves choosing between Stateful Session Cookies and Stateless JWTs for managing credential expiration and revocation. Session cookies store authentication state server-side, enabling immediate revocation by simply deleting the session entry when credentials expire or are compromised. JWTs eliminate server-side storage overhead but cannot be revoked instantly without maintaining a centralized blacklist, creating a window where stolen tokens remain valid.

The trade-off becomes critical when considering the 'exp' claim in JWTs, which middleware validates during token verification. However, this validation only prevents future use after expiration—it cannot invalidate tokens that have already been issued. For applications requiring strict least-privilege enforcement with rapid access revocation, this delay may be unacceptable.

Which approach provides the optimal balance between immediate credential revocation capability and system performance for applications with strict security requirements?