If you are using axios or a similar promise-based http request lib you can simply destroy token on the front-end inside the .then() part. It will be launched in the response .then() part after user executes this function (result code from the server endpoint must be ok, 200). After user clicks this route while searching for data, if database field user_enabled is false it will trigger destroying token and user will immediately be logged-off and stopped from accessing protected routes/pages. We don't have to await for token to expire while user is permanently logged on.
function searchForData() { // front-end js function, user searches for the data
// protected route, token that is sent along http request for verification
var validToken = 'Bearer ' + whereYouStoredToken; // token stored in the browser
// route will trigger destroying token when user clicks and executes this func
axios.post('/my-data', {headers: {'Authorization': validToken}})
.then((response) => {
// If Admin set user_enabled in the db as false, we destroy token in the browser localStorage
if (response.data.user_enabled === false) { // user_enabled is field in the db
window.localStorage.clear(); // we destroy token and other credentials
}
});
.catch((e) => {
console.log(e);
});
}