node.js - Invalidate JWT Token in NodeJS -

I used to use the JWT token behind it, the token has expired only for 5 minutes, but what if Do I want to invalidate the token after using 1 minute? I want to be able to call an API call at / api / logout and it should remove my token.

I am using Express and Node

It seems that what I can collect to do is my option tokens DB that stores tokens. When I want to end my token, I finish / ends the token with DB.

I have physically seen the tokens being "removed" with hard work, but I did not know where the token was physically stored for me to remove. The general advantage of

Token Authentication is that the token can contain information from all sessions that you can usually put in your session store. It saves a lot of resources, especially in the request-to-response time, because you do not have to see session data on every request - the customer gives you all that.

However, this does not cost you the ability to cancel the JWT token at one time because you lost track of the state .

A clear solution to place an illegal token list somewhere. Your database type removes the above mentioned benefits because you have to consult the database on every request.

A better option would be for the short-term JWT Token , i.e. token valid for only one minute web application, an average user can make several requests in a minute Is navigating around). You can give each user a JWT token which will be left for a minute and when there is a request with an expired token, you will give them a new issue.

Update : Issuing a new access token after launching an expired token is a bad idea - you invalidate an expired token Should behave as if it is forged. Better view is that the customer exists, to prove the identity of the user, and then only release new access tokens. Note that confirmation of a fresh token should be an important operation, i.e. you should have a list of all valid fresh tokens for every user anywhere in their database, because if the agreement with the refresh token has been reached, then that user Should be a means of making tokens illegal.