Saving JWT's in any medium is a security risk. The blacklist method needs to be stopped.
The most straightforward example one can give:
- Hacker gains access to your database.
- Hacker reads all invalidated tokens in the blacklist.
- Hacker clears the blacklist. Now all blacklisted tokens are back to Active and Good state.
- Hacker does bad things with the stolen, previously-blacklisted-but-not-anymore, list of tokens.