I’ve been reading a few articles on how to implement JWTs and adding claims in these tokens to validate the request and the credentials but what I noticed are different ways to handle such tokens. In one article the tutorial followed a pattern to save the tokens in the DB and when it was time to refresh the token it would validate the token from the DB and check if the token saved in the DB is expired or not. If not, then it would reissue a new token to save in the DB.

In another article, saving the token in a DB is unnecessary (which I agree with more on this). My question would be, what would be the best approach or practices in handling JWTs and refreshments if the token isn’t valid? I’m a bit confused on how to approach the solutions but any suggestions and articles would be great. This is a personal project btw. I know there are tools out there that would make my life easier but I’m just curious about implementing my own JWTs and handling them.

Also, technology that I am using or planning to use are .NET 7 Web API