Should I return user data in an authentication endpoint using JWT?

Question

I implement an auth endpoint which takes an email and password and returns a JWT token. Inside the JWT there is a payload containing the user ID. Does it matter from a REST/JWT standards perspective which of these approaches I take?

return the token and let the client request the /users/user_id resource on a callback with the decoded user_id and the token
return the entire user object with the token from the /auth endpoint for the convenience of the client.

(my question is implementation/library agnostic and about the api-design pattern)

user_2422826 · Answer

Here is a link to a more thorough discussion and answer to this question on the Software Engineering Stack Exchange

To summarize the discussion there; if the API is internally used then it matters less, if you are providing an external API with multiple consumers it matters more. There is no discussion of any security risks with either approach.

Should I return user data in an authentication endpoint using JWT?

1 Answers