If you choose to use JWTs I suggest still keeping a database of tokens and validate against that. This way you have an option to revoke the token and force clie

If you choose to use JWTs I suggest still keeping a database of tokens and validate against that. This way you have an option to revoke the token and force client to get a new one. This is useful for when token data becomes stale, e.g. email changed, roles added etc. Simply keeping it all in token is not enough.