Real World Example

Gmail, Netflix and Amazon keep you logged in for weeks but still let you "sign out of all other sessions" from a settings page. That is refresh tokens with revocation. Banking apps (HDFC, ICICI, SBI YONO) use the same parts with stricter numbers: access tokens of a few minutes and a refresh token that also expires after a few minutes of inactivity.

@RestController
@RequestMapping("/api/me/sessions")
public class SessionController {

    private final RefreshTokenRepository tokens;
    private final UserRepository users;

    public SessionController(RefreshTokenRepository tokens, UserRepository users) {
        this.tokens = tokens;
        this.users = users;
    }

    @PostMapping("/revoke-all")
    @Transactional
    public Map<String, String> revokeAll(Authentication auth) {
        User me = users.findByEmail(auth.getName()).orElseThrow();
        tokens.revokeAllForUser(me.getId());
        return Map.of("status", "All devices will be logged out within 15 minutes");
    }
}

curl -i -X POST localhost:8080/api/me/sessions/revoke-all -H "Authorization: Bearer $TOKEN"

HTTP/1.1 200 OK
{"status":"All devices will be logged out within 15 minutes"}