solve the jwt lifecycle problem

[nourabousoha]

@rebirthtobi We have to solve the problem of the token life cycle what should be done if the user logout.
should we start those token in the database and delete them in the end of the session.
we need your help tobi

[rebirthtobi]

Depends on the way we store the token, although it will be stored using local storage or session storage. On click on logout, it will delete the session storage and local session on the client side and there is nothing to do on the client side

[nourabousoha]

I mean the token that give access to the api It will be always a valid one and if someone keep his token he will always be able to use it
so the solutions i read in tutos speak about keeping trace of all the deleted ( a kind of blacklist )used tokens in the database and assure that the users don't use them again.
please have a look to this post. https://stackoverflow.com/questions/31919067/how-can-i-revoke-a-jwt-token