I have a nodejs as the api server and react as the web app. I only use jwt token to authenticate users and store the token in browser local storage. How do I force a user to logout?
3 Answers
You better store token in your server side. Then you can easily revoke or remove a token. User has to authorize or validate token each time when they use your api. If your use express session, you can just call req.session.destroy().
The token can contain an expiration date as part of the payload. This way every time you make an api call with that token you can check if the date is expired.You can have middleware that performs this check on every request. If the token is expired, you can force them to re-login and assign a new token at that point.
Related