title: How to invalidate tokens after password change
body: <p>I am working on an API that uses JWT token auth. I've created some logic behind it to change user password with a verification code &amp; such.</p>
  
  <p>Everything works, passwords get changed. But here's the catch:
  Even if the user password has changed and i get a new JWT token when authenticating...the old token still works.</p>
  
  <p>Any tip on how i could refresh/invalidate tokens after a password change?</p>
  
  <p>EDIT: I've got an idea on how to do it since i've heard you can't actually invalidate JWT tokens.
  My idea would be to create a new user column which has something like "accessCode" and store that access code in the token. Whenever i change the password i also change accessCode (something like 6 digit random number) and i implement a check for that accessCode when doing API calls (if the accesscode used in the token doesnt match the one in the db -> return unauthorized). </p>
  
  <p>Do you guys think that would be a good approach or is there some other way ?</p>