title: How to use jti claim in a JWT
body: <p>The <a href="https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7" rel="noreferrer">JWT spec</a> mentions a jti claim which allegedly can be used as a nonce to prevent replay attacks:</p>
  <blockquote>
  <p>The &quot;jti&quot; (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object; if the application uses multiple issuers, collisions MUST be prevented among values produced by different issuers as well. The &quot;jti&quot; claim can be used to prevent the JWT from being replayed. The &quot;jti&quot; value is a case-sensitive string. Use of this claim is OPTIONAL.</p>
  </blockquote>
  <p>My question is, how would I go about implementing this? Do I need to store the previously used jtis and issue a new JWT with every request? If so, doesn't this defeat the purpose of JWTs? Why use a JWT instead of just storing a randomly-generated session ID in a database?</p>
  <p>My REST API has a Mongo database and I'm not opposed to adding a Redis instance. Is there a better authentication option than JWT? I mainly just don't want to store passwords on the client which eliminates HTTP authentication as an option, however, as I'm getting deeper into this JWT stuff, I'm starting to feel as if a custom token implementation or different standard might better suit my needs. Are there any node/express packages for token based authentication that supports token revocation and rotating tokens?</p>
  <p>Would appreciate any advice.</p>