3 ms·

> That's what makes JWT-based calls stateless: > I decrypt it to get the userId, then do the role lookup A if every auth needs a database lookup then it is no

by afiori 1y ago

> That's what makes JWT-based calls stateless: > I decrypt it to get the userId, then do the role lookup A if every auth needs a database lookup then it is not stateless. A JWT is stateless if and only if you trust its signature "offline"