title: JWT, Using a dynamic secret key stored in DB
body: <p><strong>I need some advice about future pitfalls and problems if I go forward with below approach.</strong></p>
  
  <p>I am using JWT and I need to expire all previous tokens of a user when he/she changes his/her password.</p>
  
  <p>The approach I took to make a unique secret key for each user is concatenation my secret key and user password (<code>config.jwtSecretKey + user.password</code>) to generate a dynamic secret key.
  Once the user changes his/her password the secret key will change and hence all previous tokens will be invalid.</p>
  
  <p>Things are working fine but to validate each token I need a DB call to get the password.</p>
  
  <p>Please suggest how can I improve this or what is the right way to do the same.</p>