The Ghost Session

CRITICAL — compromised account still active

Security Team: User 884 disabled after stolen device — JWT still authenticating with 23 hours on exp.

The trap: Middleware only checks signature + expiration. Stateless JWTs never consult a revocation list — the token becomes a ghost session.

Your task

Fix `authenticate_request()` in `auth_middleware.py`: extract jti from the payload and call redis_client.is_revoked(jti) before granting access.

Book: JWTs are stateless — no DB lookup · Prod: add a Redis blocklist for killable sessions.