title: Best practices to invalidate JWT while changing passwords and logout in node.js?
body: <p>I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. </p>
  
  <p>I have the idea below to handle above 2 cases by hitting the user database. </p>
  
  <p>1.Incase of password changes, I check for password(hashed) stored in the user db.</p>
  
  <p>2.Incase of logout, I save last-logout time in user db, hence by comparing the token created time and logout time, I can able to invalidate this case.</p>
  
  <p>But these 2 cases comes at the cost of hitting user db everytime when the user hits the api. Any best practise is appreciated.</p>
  
  <p><strong>UPDATE:</strong>
   I dont think we can able to invalidate JWT without hitting db. So I came up with a solution. I have posted my answer, if you have any concern, you are welcome.</p>