title: password reset with jwt structure
body: <p>I'm trying to write the password reset part of my authentication app. I chose to use JWT, node.js and express where I use the following logic: first, the user enters their email and a token is generated and sent to the user's mail in a password reset link. second, when the user presses the link  a function is set to check if the token is correct and if it's still valid and third i have a function to save the new password to the database. </p>
  
  <p>What I'm uncertain about is the second step where the token is supposed to be checked. Some tutorials say that you're supposed to save the token to your database and then compare the token in the link to the token in the database. But isn't the point with using JWT to not save anything to the database as reference? Shouldn't I just use jwt.verify to get the information saved in the token and then check for the user in the database and if it's still active? </p>
  
  <p>Is this the correct way of using JWT? Or would you recommend me to use session instead of JWT? </p>