title: Storing flask-jwt auth token. Can I / should I store in database?
body: <p>I don't know if any of this is the correct way to do this. But here it goes.</p>
  
  <p>(Please let me know if any of this is totally wrong)</p>
  
  <p>I want to store a JWT against a user in flask, is it correct for me to store this in the database?</p>
  
  <p>Currently I'm attempting to check on each request if they have a valid token but am getting a new token each time.</p>
  
  <p>I'm using this.</p>
  
  <pre><code>app.before_request(check_token)
  
  def check_token(*args, **kwargs):
      if current_user:
          if current_user.is_authenticated:
              if not hasattr(current_user, "token"):
                  set_token()
              elif current_user.token_time + timedelta(seconds=current_app.config["TOKEN_SECONDS"]) &lt; datetime.utcnow():
                  set_token()
  </code></pre>
  
  <p>Obviously I've found it doesn't preserve the current_user so the token changes every time I make a new request.</p>
  
  <p>1) Is it good practise to save this token in the database? I'm giving it 300 seconds currently. Or is there another way to save it against the current user?</p>
  
  <p>2) I'm using Flask to render the page and I store the users token like this </p>
  
  <pre><code>&lt;button data-token="asdkjhakjsdnkcz8323lkn42lk3n4kj2nkjn2kj3b4kjnlkj32"&gt;  
  </code></pre>
  
  <p>Which I then pass to javascript Xhttp requests to update post comments on the fly. Seems like I probably shouldn't but with such a short validity period seems ok? </p>