Usually I store the hashed password reset tokens in a database like MySQL.
In my current application I use JWT to reduce the number of database queries. I also use Redis to keep track of valid JWTs, now I'm wondering why I should not just save the password reset tokens in Redis and map the token to the user id + timestamp (to deny old tokens).
The only reason I can think of is memory usage.
Is there another reason not to do this ?
You would introduce a point of failure, namely Redis.
If keeping track of valid JWTs is a way to check a JWT for revocation, then you probably have that point of failure already. What happens if Redis is unavailable? You would either deny access (hence the point of failure) or accept any verified JWT as valid (not revoked).
If the later is true, storing reset tokens in Redis would just make that dependency explicit: if Redis is down, you can't change password.
