Is there a way to revoke both refresh token and access token when logout?

I create both refresh token and access token when login. However, when logout, those tokens should be revoked at the same time, without affecting other tokens owned by the user. I look at the doc. Like:

# Endpoint for revoking the current users access token
@app.route('/logout', methods=['POST'])
@jwt_required
def logout():
    try:
        _revoke_current_token()
    except KeyError:
        return jsonify({
            'msg': 'Access token not found in the blacklist store'
        }), 500
    return jsonify({"msg": "Successfully logged out"}), 200


# Endpoint for revoking the current users refresh token
@app.route('/logout2', methods=['POST'])
@jwt_refresh_token_required
def logout2():
    try:
        _revoke_current_token()
    except KeyError:
        return jsonify({
            'msg': 'Refresh token not found in the blacklist store'
        }), 500
    return jsonify({"msg": "Successfully logged out"}), 200

Is there a way to revoke both?

[drewswiredin]

Running into the same issue here. I don’t want to store anything about tokens on the server other than blacklisted token ids in Redis. My current solution is to embed a reference to the refresh token id inside the access token. By doing so, I am able to blacklist both token’s id’s on logout. Not sure if this violates any JWT principles but it’s the best I could come up with.

[vimalloc]

Yeah, this was is honestly some great information that could probably use more exposure. If someone wants to update the docs/examples to highlight how this could be done I would very much welcome a pull request 👍