title: REST Security with JWT
body: <p>I recently discovered JWT for token authentication + authorization.
  I think is very useful to have user info wrapped in the token, so I'm trying to use it in a Java/Spring web project.</p>
  
  <p>At first, my impressions were: if I have all the user data in token I don't need to store it in application DB and I don't need to retrieve user + session information for every service request. This is fantastic and could improve effectively service access performance.</p>
  
  <p>But now I'm having some doubt on JWT "limitation" for my use case. For example: what If the user is disabled by service admin and the last generated token is not yet expired? The user can access to the service even if it is actually not authorized...</p>
  
  <p>Is this a limitation of JWT or am I missing something? Can you clarify my doubt?</p>