title: How to invalidate a JWT token with no expiry time
body: <p>Am creating a node.js backend app using JWT. For me the requirement is simple, that the authorization token shouldn't have any expiry time. But I am facing problem during invalidating JWT When user changes his password. </p>
  
  <p>When user changes his password, I will create a new JWT Token, and delete the old token, but still the user can use his old JWT token (from other logged in devices) and can access the application.</p>
  
  <p>So can anyone tell me how to avoid this scenario?</p>