At some point we need to implement this I think. It's not a massive rush though as this can be left to the developer. It's also not super trivial but if you are using HTTPS, because we don't expose the JWT in the query string, it's not very likely that it would be maliciously stolen.
See https://auth0.com/blog/2015/03/10/blacklist-json-web-token-api-keys/ for details.
At some point we need to implement this I think. It's not a massive rush though as this can be left to the developer. It's also not super trivial but if you are using HTTPS, because we don't expose the JWT in the query string, it's not very likely that it would be maliciously stolen.
See https://auth0.com/blog/2015/03/10/blacklist-json-web-token-api-keys/ for details.