I am building a REST API back-end for a mobile application. In our design choice we decided to let OAuth2 providers handle the login security; however, I am not sure what the best practice is for the access token, which I acquire from the OAuth2 providers.
The situation is I get an access token from the OAuth2 provider when the user makes a login. I will need to use this token every time the mobile application makes a request to my back-end so I can validate against the OAuth2 provider to see if the token is still valid.
I know that I am going to create a JWT and hand it to the mobile application, which it will use every time it makes a request. Now my question is should I store the access token, which I got from the OAuth2 provider, inside the JWT as claims or should I store it in a database and connect it with the users' ID, which I will store in the JWT claims?
Perhaps it is recommended that I encrypt the JWT with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or Redis) or will performance impact be the same?
The connection to my REST API will be through HTTPS.