JSON Web Token

[wlkns]

Isn't the idea to sign the web token dynamically and not store it in the database?

[simdm]

update mongoose

[cryptoPickle]

jwt generally used for as you mentioned, however i could not figure how to invalid the token when user logged out, due to that reason , i am storing the token on database, when user performs logout, token would remove from database. Like this way it is making a naive invalidation for the token, and user can't login with the token invalidated before.