I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security.
However, I am not sure what the best practice is for the access token, which I acquire from the OAuth2 providers.
The situation is, I get an access token from the OAuth2 provider, when the user makes a login. I will need to use this token, every time the mobile application makes a request to my back-end. So I can validate up against the OAuth2 provider, to see if the token is still valid.
I know that I am going to create a JWT, and hand it to the mobile application, which it will use every time it makes a request.
Now my question is, should I store the access token which I got from the OAuth2 provider, inside the JWT as claims.
Or should I store it in a database, and connect it with the users ID, which I will store in the JWT claims?
Perhaps it is recommended that I encrypt the JWT, with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or Redis) or will performance impact be the same?
The connection to my REST API, will be through HTTPS.