What is secured about JWT?
c#, jwt, oauth, oauth-2.0
Solution
The first two segments of a JWT aren't encrypted, so any app that generates a JWT on the server and sends it back to a client should do so over SSL. This is typically sent to the user as a response to a request to login which should be sent over SSL anyway because it typically contains a username and password combination. Subsequent requests sent to the server should be done over SSL as well, because no matter what sort of token you use - be it JWT or something else - it should not be visible in unencrypted form to packet sniffing, otherwise user sessions can be hijacked.
The security aspect of JWT comes from the third and final segment. It is generated by signing the first two segments with a secret key that only the server knows. When a JWT that a server generated is sent back to that server as part of an authenticated request, the server knows the key and can therefore validate the signature in the third segment and use that signature to ensure the first two segments have not been modified since being signed by the server.
Problem
I am using JWT in order to produce and consume tokens. After weeks of reading specs and googling, i still don't understand: what is secured about the token if I can produce it on one machine and then open it on another? Is the written token supposed to be encrypted somehow? I am using `System.IdentityModel.Tokens` and creating token using `JwtSecurityToken` and `JwtSecurityTokenHandler`. Can someone please point me to a focused documentation on subject that mainly explains the security aspect of it please?