node.js - Invalidate JWT Token in NodeJS -

i followed tutorial using jwt token. token expiry set 5 minutes, if wanted invalidate token after 1 minute of use? want able make api call /api/logout , should delete token.

i'm using express , node.

it seems gather option have token db stores token. when want expire token, expire/remove token db.

i've seen people casually "remove" token physical hard space, cannot figure out token physically stored me remove it.

the general benefit of jwt token authentication tokens can contain session information keep in session store. saves considerable resources, in request-to-response times, because not have session data on each , every request - client gives that.

however, comes @ cost of not being able revoke jwt token @ time of choosing, because lost track of state.

the obvious solution of keeping list of invalidated tokens somewhere in database kind of removes above-described benefit because again have consult database on every request.

a better option issue short-lived jwt tokens, i.e. tokens valid 1 minute. web application, average user may perform several requests in minute (a user navigating around app). can give each user jwt token last minute , when request expired token arrives, you issue them new one.

update: issuing new access token after presenting expired token bad idea - should treat expired token invalid, if has been forged. better approach have client present refresh token prove user's identity, , issue new access token. note verifying refresh token must stateful operation, ie. must have list of valid refresh tokens per user somewhere in database, because if refresh token compromised, user must have means of invalidating token.