title: Node js, JWT token and logic behind
body: <p>I'm using the JWT to protect node js urls <a href="https://github.com/auth0/express-jwt">https://github.com/auth0/express-jwt</a></p>
  
  <p>To create a JWT token user session i simply do:</p>
  
  <pre><code>-&gt; auth/signup
      -&gt; jwt.sign(user_profile,secret,expireInMinutes:{900000000 /*almost never expires*/});
  </code></pre>
  
  <p>OR in case of login call</p>
  
  <pre><code> -&gt; auth/login
          -&gt; jwt.sign(user_profile,secret,expireInMinutes:{900000000 /*almost never expires*/});
  </code></pre>
  
  <p>Every time a protected url is called i check for <code>req.user</code> that is set up automatically by the JWT middleware.</p>
  
  <p>Now I'm wondering:</p>
  
  <p>1 - where does JWT tokens are stored when calling sign() ?</p>
  
  <p>2 - do i have to verify() the token every time a protected url is called? if yes why?</p>
  
  <p>3 - When i set a new token for an already signed user does the old token (if exists) gets deleted ? What if the expiration is not been set up or is 5 years for example?</p>
  
  <p>4 - Why can't I set new tokens on same browser/app page ?
   I get invalid signature error if i register a new token but the token matches (i checked)
   It's like I can't signin more than 1 user on same browser</p>