Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature).

In my opinion signature checking is just a waste of resources, but person who designed system insist on using JWS as he claims is more secure. Did I missed something? Is it right way to go?

  • Your question title is about gain from storing JWS in DB, but the body is asking about signature validation. Can you clarify really what you're trying to figure out?
    – Omer Iqbal
    Apr 27, 2019 at 10:17
  • @OmerIqbal i wonder is it any gain from storing jwt token on the backend in database. random generated token would do same job
    – user902383
    Apr 29, 2019 at 10:17


You must log in to answer this question.

Browse other questions tagged .