I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding:
- When a user logs in, the server will create a JWT the third part of which is a signature that is created using a secret key.
- In further calls to the API, the user can include the JWT in the header, and the server will be able to check the signature, again using the secret key. This means that an attacker that has intercepted the JWT cannot change the payload in any way, because if they do, then the signature will not match.
- If an attacker manages to get hold of a JWT, will this enable them to use the API as if they were the user that had originally authenticated?
- I was thinking of including an expiry timestamp in the payload so that the user had to log in occasionally. Is this the correct way of expiring the JWT?