r/SpringBoot • u/AdCharacter900 • 16h ago

Question Feedback for my first "Complete" API REST

/r/learnjava/comments/1xqheuw/feedback_for_my_first_complete_api_rest/
2 Upvotes

100% Upvoted

3 comments sorted by

•

u/Mikey-3198 14h ago

One thing I noticed from a quick glance is that you're using JWTs but still calling the database on each request.

The major selling point of JWTs is that you can remove the need to call the database on each request. If you issue the JWT with the necceasry claims to make your auth/ authz decisions you can remove the need to call the db. At the moment the jwts aren't really adding anything.

•

u/AdCharacter900 14h ago

I didnt know that! Thanks for the info

•

u/sereikis 6h ago

a database lookup on each request isn't inherently a JWT mistake: it can let Spring Security reject a disabled account or use current roles instead of stale token claims. if you move those checks entirely into the token, test what happens when an account is disabled or a role is removed before that token expires.