Should I pass all information needed to fulfill the request in a JWT-token between a SPA and an API, or should the API get extended profile information from a database upon recieving the token?
valid question