在哪里存储社交登录 Oauth2 访问令牌

Question

I'm trying to build a Spring Boot REST API that will implement social login(Spotify). After successful login with Spotify, I would like to store the Spotify access_token in my JWT token that I'm generating to be able to access my backend. I need a Spotify access token to be able to make API calls to Spotify(almost every request to my app will need to call Spotify API). Is it a good practice to store access tokens to external services in JWT? Or should I store the access token in my DB and read it when I need it? Maybe do you have any guides on how to implement stateless REST API that will call external services?

Answer 1

usually, I store access token in Redis, it's faster then DB. if you use DB, every quest will link DB twice，one for get user infomation(like username and password)，one for read the access token. When the frequency of quest is very small，it's ok. but when the frequency of quest more and more, store in DB, will very waste of performance. Use Redis have another advantage，it has expire time. So, most of my project, I use Redis store token.