I'm assuming that was your question on Stack Overflow, can you edit it to state what you asked here because you didn't mention anything about invalidating the JWT. (do pardon me if my assumption that the SO question is yours).