I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security.

However, I am not sure what the best practice is for the access token, which I acquire from the OAuth2 providers.

The situation is, I get an access token from the OAuth2 provider, when the user makes a login. I will need to use this token, every time the mobile application makes a request to my back-end. So I can validate up against the OAuth2 provider, to see if the token is still valid.

I know that I am going to create a JWT, and hand it to the mobile application, which it will use every time it makes a request.

  Now my question is, should I store the access token which I got from the OAuth2 provider, inside the JWT as claims.
Or should I store it in a database, and connect it with the users ID, which I will store in the JWT claims?

Perhaps it is recommended that I encrypt the JWT, with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or Redis) or will performance impact be the same?

The connection to my REST API, will be through HTTPS.

I am building a REST API back-end for a mobile application. In our design choice we decided to let OAuth2 providers handle the login security; however, I am not sure what the best practice is for the access token, which I acquire from the OAuth2 providers.

The situation is I get an access token from the OAuth2 provider when the user makes a login. I will need to use this token every time the mobile application makes a request to my back-end so I can validate against the OAuth2 provider to see if the token is still valid.

I know that I am going to create a JWT and hand it to the mobile application, which it will use every time it makes a request. Now my question is should I store the access token, which I got from the OAuth2 provider, inside the JWT as claims or should I store it in a database and connect it with the users' ID, which I will store in the JWT claims?

Perhaps it is recommended that I encrypt the JWT with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or Redis) or will performance impact be the same?

The connection to my REST API will be through HTTPS.

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let oauth2 providers handle the login security.

However, I am not sure what the best practice is for the access token, which I acquire from the oauth2 providers.

The situation is, I get an access token from the oauth2 provider, when the user makes a login. I will need to use this token, every time the mobile application makes a request to my back-end. So I can validate up against the oauth2 provider, to see if the token is still valid.

I know that I am going to create a JWT, and hand it to the mobile application, which it will use every time it makes a request.

Now my question is, should I store the access token which I got from the oauth2 provider, inside the JWT as claims. Or should I store it in a database, and connect it with the users ID, which I will store in the JWT claims?

Perhaps it is recommended that I encrypt the JWT, with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or redis) or will performance impact be the same?

The connection to my REST API, will be through HTTPS.

Thanks in advance.

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security.

However, I am not sure what the best practice is for the access token, which I acquire from the OAuth2 providers.

The situation is, I get an access token from the OAuth2 provider, when the user makes a login. I will need to use this token, every time the mobile application makes a request to my back-end. So I can validate up against the OAuth2 provider, to see if the token is still valid.

I know that I am going to create a JWT, and hand it to the mobile application, which it will use every time it makes a request.

Now my question is, should I store the access token which I got from the OAuth2 provider, inside the JWT as claims. 
Or should I store it in a database, and connect it with the users ID, which I will store in the JWT claims?

Perhaps it is recommended that I encrypt the JWT, with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or Redis) or will performance impact be the same?

The connection to my REST API, will be through HTTPS.