I'm wondering whether it is bad practice to keep a user's ID in a JWT.
I'm planning on using the email in the
sub, since it's already available to them, and I can use it to identify them, all the same. I can let the DB index it so it's easier to retrieve their information using the email rather than the ID.
Isn't it better to avoid giving the user any information regarding how the DB is referencing them, as in the ID? My concern is that I don't know why everyone is fine with using the ID stored in the DB in a JWT, since it can be easily avoided. Isn't there a scenario where it's not a good idea to give them their DB stored ID? The more vague the information, or already available information the user has about themselves, the better, right?