Store JWT token in cookie

Question

This is my setup:

• 1 authentication server which gives out JWT token on successfull authentication.
• Multiple API resource servers which gives information (

Answer 1

Are you generating your own JWTs?

If yes, you should consider using a signing algorithm based on asymetric encryption, like "RS256" or "RS512" -- this way you can verify the claims in your client application without sharing the private secret.

Do you really need to pass the JWT into the Cookie?

It might be safer to just put a random id in your Cookie, which references the JWT access token, and do the de-referencing magic on the server which serves your web-app.