Azerbaijani)
Ideally the correct way of jwt implementation is just by allowing the token to expire. Upon logout you can delete(forget) the token on the client side so it will have no token so it means the user is logged out.(Although the token will work until it expires.who ever have that particular token can use it). But if you want to force logout and avoid reuse of that token at the time of logout.You need to have custom solution and store the generated token on the server somewhere and upon logging out you can blacklist(invalidate) the token and when other request comes with that token you can check against the blacklisted ones and force to relogin again.(But this approach will defeat the whole idea of jwt since it is stateless) Hope that helps
Обсуждают сегодня