Maybe the author meant permissions such as 'read-only' or 'read-write' that place additional restrictions on a token.
Anything else would cause a lot of problems. Role permissions might change while a token is still active.
Anything else would cause a lot of problems. Role permissions might change while a token is still active.
I was actually referencing this article: https://auth0.com/blog/2014/12/02/using-json-web-tokens-as-a...