I have used JWT in my application and found it interesting as they don't require a database lookup, which makes them faster and puts less load on the database.
A major concern with JWT is related to security reasons for my application which is REST API's based where user needs have a token with them to access those endpoints. If a token is accidentally leaked I need to make another table in the database and verify if an incoming token is valid or not which is kind of similar to authenticate a user from a database.
I can use some cache-based databases like Redis and make operation faster but is there some alternative so that I can minimize database read/write operations?
Technically you need something to validate the incoming token which can be done with some public/private key similar to JWT but the problem lies while changing the key.
How does Facebook/Twitter or similar manage access token for their app(not mobile app 🙂)? Do they make a query with their database or have something similar to JWT. (This part of the question is just for a hint to get their implementation method and not as an opinion or something to invalidate this question, a part can remain unanswered).