Answer the question
In order to leave comments, you need to log in
If the token is valid, is it necessary to check for existence in the user's database?
Do I need to check for the existence of a user in the database when checking a JWT token?
Or does a valid token itself serve as proof of the user's existence?
Example, in payload I store the user id.
Do I need to check for the existence of a user with the specified id in the database?
As I understand it, this is an extra case?
I only came up with the case when they stole SECRET_KEY and created their own JWT with a non-existent id, but why?
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question