title: Destroying JSON Web Tokens
body: <p>This is something,that really confuses. me. Let us suppose you have a REST API where you want the user to logout. After login out,the jwt(json web token) should be destroyed,so the user can not have access to the server's resources(ie menu,dishes etc). </p>
  
  <p>In my case the user can logout,but he/she can still perform all the requests(get dishes,post and delete),until the token is valid. Here is my code.</p>
  
  <p><strong>verify.js</strong></p>
  
  <pre><code>var User = require('../models/user');
  var jwt = require('jsonwebtoken'); // used to create, sign, and verify tokens
  var config = require('../config.js');
  
  exports.getToken = function (user) {
        return jwt.sign(user, config.secretKey, {
            expiresIn: 3600
        });
  };
  
  exports.verifyOrdinaryUser = function (req, res, next) {
      // check header or url parameters or post parameters for token
      var token = req.body.token || req.query.token || req.headers['x-access-token'];
  
      // decode token
      if (token) {
          // verifies secret and checks exp
          jwt.verify(token, config.secretKey, function (err, decoded) {
             if (err) {
                 var err = new Error('You are not authenticated!');
                 err.status = 401;
                 return next(err);
             } else {
                 // if everything is good, save to request for use in other routes
                 req.decoded = decoded;
                 next();
             }
          });
       } else {
          // if there is no token
          // return an error
          var err = new Error('No token provided!');
          err.status = 403;
          return next(err);
       }
  };
  </code></pre>
  
  <p>I am invalidating the token after a period of 1 hour. </p>
  
  <p>And <strong>users.js</strong> where I set all the routes with their tasks. ie <em>localhost:3000/users/login</em>,<em>localhost:3000/users/register</em> and <em>localhost:3000/users/logout</em>. So.</p>
  
  <pre><code>var express = require('express');
  var router = express.Router();
  var passport = require('passport');
  var User = require('../models/user');
  var Verify    = require('./verify');
  /* GET users listing. */
  router.get('/', function(req, res, next) {
     res.send('respond with a resource');
  });
  
  router.post('/register', function(req, res) {
      User.register(new User({ username : req.body.username }),
      req.body.password, function(err, user) {
          if (err) {
             return res.status(500).json({err: err});
          }
          passport.authenticate('local')(req, res, function () {
               return res.status(200).json({status: 'Registration Successful!'});
          });
      });
  });
  
  router.post('/login', function(req, res, next) {
      passport.authenticate('local', function(err, user, info) {
        if (err) {
          return next(err);
        }
        if (!user) {
          return res.status(401).json(
              err: info
            });
        }
        req.logIn(user, function(err) {
          if (err) {
            return res.status(500).json({
               err: 'Could not log in user'
            });
        }
  
        var token = Verify.getToken(user);
        res.status(200).json({
           status: 'Login successful!',
           success: true,
           token: token
        });
     });
   })(req,res,next);
  });
  
  router.get('/logout', function (req, res) {
      req.logout();
      res.status(200).json({
         status: 'Bye!'
      });
  });
  
  module.exports = router;
  </code></pre>
  
  <p>It seems that the logout method <em>req.logout</em>,doesn't work:(. Any ideas? </p>
  
  <p>Thanks,</p>
  
  <p>Theo.</p>