So, i’m currently building a web app using JWT for auth using token rotation method whereas my access token is refreshing its data every 5 minutes, but i stumble across a concern about using user role information in access token payload.
My concern is, in a case where admin demote a user role, that user will not be automatically demoted in span of 1 – 5 minutes because he still has the existing access token right?
What is the best that i can do with that situation? should i :
Trust that 1 – 5 minutes rotating token?
Make access token more short lived ex. 15 seconds?
Authorize user role using database call every authorization is needed? or is there any other method?
M. Windu Pratama is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.