So, i’m currently building a web app using JWT for auth using token rotation method whereas my access token is refreshing its data every 5 minutes, but i stumble across a concern about using user role information in access token payload.
My concern is, in a case where admin demote a user role, that user will not be automatically demoted in span of 1 – 5 minutes because he still has the existing access token right?
Whats the best that i can do with that situation? should i :
- Trust that 1 – 5 minutes rotating token?
- Make access token more short lived ex. 15 seconds?
- Authorize user role using database call every authorization is needed?
or is there any other method?
New contributor
M. Windu Pratama is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.