title: Is it a good practice to store JWT Tokens in memory
body: <p>I wrote an <strong>asp.net core 3.0</strong> web api where I am using JWT tokens to authenticate a user. Once the user gets token, he/she can use it until it expires.</p>
  
  <p>What I have done is that I have also stored this token in-memory on authentication, to get other minimal details e.g. username, token generated at and "token".</p>
  
  <ol>
  <li><p>My first question is that is it a good practice? since tokens are stateless and therefore saves server side from the hassle of maintaining it.</p></li>
  <li><p>My second question is that if it is acceptable to do so, then how do I remove this token information from in-memory once a token expires.</p></li>
  <li><p>If I am not storing this token in memory, how to extract information like "get a list of all logged-in users".</p></li>
  </ol>