Search code examples
node.jsreactjsreduxjwt

When you want to change User's data, should you delete the jwt and create a new one for the session?

I am implementing in React and Node, update of user's data.

  1. After making the change in DB, should you delete that token and generate a new one?
  2. Updating values in Redux?
Solution

  • We generally do not store more than 5 fields of data in a JWT token. So, for example, you store these fields in the token:

    username
role

    Until you're modifying these fields in the database, the token is valid.

    But, in case you've modified these fields:

    1. You need to communicate the newly generated token to your React application. This ensures that the user stays logged in.

    2. Or, just redirect the user to login page as an easy fix.

    Moreover, you should not keep tokens longer than required i.e, set an expiration date on the token.