How can JWT be verified outside the authorization server
问题 Recently, I'm trying to implement an OAuth2.0 server using JSON Web Token (JWT) as access token. I'm very confused about the self-contained feature of JWT. I notice that JWT can be verified anywhere, not mandatorily in authorization server because it is self-contained. How does this feature work? What claims should be included in JWT in order to realize self-contained feature? Another question is that, if JWT is stateless, it means the server should not store the JWT. Then how is the JWT