JWT handling about oauth2 HOT 2 OPEN

Yes, the point of JWT is to not store it in a DB, therefore, the library should at least give you options of not storing JWT.

from oauth2.

The main idea behind a Bearer token is that the client holds the authorization. There is no reason that the server should store this whatsoever. As long as server A and server B are using the same encryption secret, both servers (regardless of language, OS, whatever) should be able to decode the and validate the token.

The most important part about this is that in a scenario where you are going client -> service -> service -> service , each service can retain this bearer token through the entire call process so the same authorization logic applies across the board.

I have absolutely no idea why you would ever want to database the JWT. I can see databasing the access_token property so that you can validate the JWT against an authorization server, or the refresh_token to re-issue a new JWT before the old one expires. But that's about it.

from oauth2.