Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature).

In my opinion signature checking is just a waste of resources, but person who designed system insist on using JWS as he claims is more secure. Did I missed something? Is it right way to go?

  • Your question title is about gain from storing JWS in DB, but the body is asking about signature validation. Can you clarify really what you're trying to figure out? – Omer Iqbal Apr 27 '19 at 10:17
  • @OmerIqbal i wonder is it any gain from storing jwt token on the backend in database. random generated token would do same job – user902383 Apr 29 '19 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.