[user5994461]

This just made me realize. There is an even simpler way to achieve the same result without a database.

The token includes the time when it was created (iat attribute) so critical actions could check that the token is less than 3 minutes old.

[gorgonian]

Yeah that’s what I did, with iat info. But I did that for every request, and critical actions always hit the db.