title: Invalidating JSON Web Tokens
body: <p>For a new node.js project I'm working on, I'm thinking about switching over from a cookie based session approach (by this, I mean, storing an id to a key-value store containing user sessions in a user's browser) to a token-based session approach (no key-value store) using JSON Web Tokens (jwt).</p>
  
  <p>The project is a game that utilizes socket.io - having a token-based session would be useful in such a scenario where there will be multiple communication channels in a single session (web and socket.io)</p>
  
  <p>How would one provide token/session invalidation from the server using the jwt Approach? </p>
  
  <p>I also wanted to understand what common (or uncommon) pitfalls/attacks I should look out for with this sort of paradigm. For example, if this paradigm is vulnerable to the same/different kinds of attacks as the session store/cookie-based approach.</p>
  
  <p>So, say I have the following (adapted from <a href="http://blog.auth0.com/2014/01/15/auth-with-socket-io/" rel="noreferrer">this</a> and <a href="http://coderead.wordpress.com/2012/08/16/securing-node-js-restful-services-with-jwt-tokens/" rel="noreferrer">this</a>):</p>
  
  <p>Session Store Login:</p>
  
  <pre><code>app.get('/login', function(request, response) {
      var user = {username: request.body.username, password: request.body.password };
      // Validate somehow
      validate(user, function(isValid, profile) {
          // Create session token
          var token= createSessionToken();
  
          // Add to a key-value database
          KeyValueStore.add({token: {userid: profile.id, expiresInMinutes: 60}});
  
          // The client should save this session token in a cookie
          response.json({sessionToken: token});
      });
  }
  </code></pre>
  
  <p>Token-Based Login:</p>
  
  <pre><code>var jwt = require('jsonwebtoken');
  app.get('/login', function(request, response) {
      var user = {username: request.body.username, password: request.body.password };
      // Validate somehow
      validate(user, function(isValid, profile) {
          var token = jwt.sign(profile, 'My Super Secret', {expiresInMinutes: 60});
          response.json({token: token});
      });
  }
  </code></pre>
  
  <p>--</p>
  
  <p>A logout (or invalidate) for the Session Store approach would require an update to the KeyValueStore 
  database with the specified token.</p>
  
  <p>It seems like such a mechanism would not exist in the token-based approach since the token itself would contain the info that would normally exist in the key-value store.</p>