If you using the token in a web application on a public or shared access machine, then the JWT token must include the expiration time (exp) claim, so that the potential for token re-use is minimized.
There is another alternative that is preferred in many commercial systems and that is to store the tokens as sessions on a secure data store. This method I have less experience in and is where it can be explored with third-party token authentication providers.
One suggestion is to store the token in localStorage.
See (https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage).
If you using the token in a web application on a public or shared access machine, then the JWT token must include the expiration time (exp) claim, so that the potential for token re-use is minimized.
There is another alternative that is preferred in many commercial systems and that is to store the tokens as sessions on a secure data store. This method I have less experience in and is where it can be explored with third-party token authentication providers.