“No.” Whenever I see such a simple answer to a complex question, I know it’s probably an oversimplification. The real answer is a solid “it depends on what yo

“No.” Whenever I see such a simple answer to a complex question, I know it’s probably an oversimplification. The real answer is a solid “it depends on what you want to achieve.” Say you handle invalidation by maintaining a cached table of revoked tokens. Is this table larger or smaller than the table of all users? Perhaps you would like to embed some RBAC info in the token. Is validating both the token and it’s absence from your revocation table more efficient than looking up all of the other information? Perhaps you need to do this on a distributed basis. Is the overhead of maintaining such a table more or less than making all the DB calls and creating a central choke point in your architecture?