We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a token, without the need to hit a database for each API call.

After evaluating the JWT we had some questions:

1. How do you handle a situation with a compromised token secret which is shared between a client and the server?

2. Do you logout all your clients and define a new token secret for future requests? (that would be a bad experience)

3. Is there a way to just logout the compromised client?

Background detail: We will use that flow between an iOS app and a Node.js backend.

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a token, without the need to hit a database for each API call.

After evaluating the JWT we had some questions:

1. How do you handle a situation with a compromised token secret which is shared between a client and the server?
2. Do you logout all your clients and define a new token secret for future requests? (that would be a bad experience)
3. Is there a way to just logout the compromised client?

Background detail: We will use that flow between an iOS app and a Node.js backend.