Search code examples
node.jsmongodbperformancejwttoken

Should I put user info in JWT token or, just the user's ID and then select the info from the DB?


Since user info can be changed, not by the user - but by some admin or someone else, token user info (payload) is not updated to info contained in the DB.

But I want to do how few DB requests as I can, so I think about storing the users info in their tokens.

I think that this is wrong, and I better just store their unique ID, which is index in MongoDB and a timestamp - so user wont have the same token over and over - he has to fulfil a login from the server.

But then I need to do a query to DB, and I want to make how few as I can.

Should I just query the DB with the user's ID and thats it?


Solution

  • Storing an ID is probably a better idea since the user data can be modified just as you said. Also large payload in JWT results in extra bytes to be sent over the network for almost every network request. In most cases you don't need the whole user data and ID will do good in most cases. So I would recommend to store ID (may be some other field too as required) in JWT instead of all the user's data.