JSON Web Token expiration : <p>On most of the JWT (JSON Web Token) tutorial (e.g: <a href="https://jwt.io/introduction/" rel="noreferrer">this</a> and <a href="https://www.toptal.com/java/rest-security-with-jwt-spring-security-and-java" rel="noreferrer">this</a>) are saying, once validated you can use the incoming token to get client information without validating it from the DB.</p>

<p>My question is, how invalid user situation is maintained then? What I mean is, lets say a client just got a JWT token which expires in one week. But for very specific reason lets say we decided to invalidate the user, and don't want the user to access our API. But still that user has a token which is valid and user can access the API. </p>

<p>Of course if we take a round trip to DB for each request then we can validate if the account is valid or invalid. My question is, what is the best way to take care this kind of situation for long lived tokens.</p>

<p>Thanks in advance.</p>
