I'm using JWT to handle an SSO scheme where two systems (let's call them A and B) both require authentication, but the user datastore is in one system only (let's say A). Everything I've seen about JWT involves the user posting username/password in order to receive the JWT, but what I'm wondering is if it's secure to return a JWT to an already-logged-in user.
To make it a bit more concrete, the authenticating system A (example.com) uses cookie/session based auth, but the second system B (subdomain.example.com) needs the JWT to authenticate. We don't want to force already-logged-in users who have a session cookie to input username/password again in order to get a JWT, so we're thinking we'll implement an API endpoint that returns a JWT to a user who is already logged in (via session auth), which the user can then user to authenticate with system B. In particular, we're using Django REST Framework JWT, which gives the option to manually create the JWT: https://getblimp.github.io/django-rest-framework-jwt/#creating-a-new-token-manually
So e.g. we'd have an API endpoint where you can
if user is already authed:
Again, the key difference between this and everything I've seen is that we're returning a JWT to a user who has already logged in.