There is an internal API, REST client over DB,  all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table.Also there is an public API, that is like a Auth+Proxy Gateway: it checks the JWT token, extract User ID and then redirect to internal API.So right now  User ID is passed as part of JWT token, so everyone can extract/know it value - the problem that I want to solve.The thirst what I thought was to change public API to work with an External User ID (GUID for example): - add additional mapping table to have mapping between external and internal ID;- external API  takes external ID from JWT, makes query to retrieve corresponding  internal user ID- call internal API using internal user IDWhat I do not like in this approach is an additional query to DB with each request. Using caching can reduce number of queries, butAnother option, that I see, is to use JWE token instead of JWT. At least one disadvantage of this approach is the encryption/decryption expenses.
External User ID to Internal User ID
security;api;microservices