I was thinking to check the user in the database on each request so I
can invalidate the account instantly. Are there any problems with this
I don't see anything glaringly wrong, but....
There are some downsides. Doing this, requires that every user-interaction lookup your database table. For a small-ish application with not many users, this ...
Here's the list of best practices in securing RESTful API.
Always Use HTTPS - Traffic must be encrypted
Never expose information on URLs - as this can be captured in web server logs, which makes them easily exploitable.
Adding Timestamp in Request - This will ...