I have an architectural problem associated with authorization.
I'm making an MMORPG multiplayer mobile game without separation onto different servers. What I mean by that is that a player from USA could have a mission with someone from China.
Currently I have an authentication microservice that issues JWT tokens. Another types of microservices are game microservices that handles all game logic. By design they would scale to meet the demand.
Every account can have multiple characters created, but only one can be online at the time.
My question is: How can I ensure that only 1 character can be online? Do I attach selected character to JWT? But the player can request another JWT with another character and the previous one would be valid as well until it expires. In this case I would need to look up database with every request, but that defies the purpose of JWT. Should I be using JWT or is there another way authorize players?