title: Revoke/Reject valid Json Web Token in ASP.NET core middleware for locked out users
body: <p>I am using the JWT middleware + ASP.NET Identity to establish a simple User/Password login in my ASP.NET Core WebAPI project.</p>
  
  <p>The tokens will be valid for 15 minutes. I think I will be utilizing the Refresh Token concept to keep the user logged in, when he is still browsing the site (SPA) or using the mobile app (What about a <code>remember me</code> option? I would create a token that's valid for a month maybe?)</p>
  
  <p><strong>So, is there any way to revoke a generated token? I am think about checking (on each request) if the user still has the right to access the API. Maybe there is another way to handle these cases?</strong></p>
  
  <p>I see a AspNetUserTokens table. Maybe there is a way to store the JWT in there automatically?! At the moment I am using ASP.NET Identity just for user authentication.</p>