Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature).
In my opinion signature checking is just a waste of resources, but person who designed system insist on using JWS as he claims is more secure. Did I missed something? Is it right way to go?