I am using JWT to verify Users. As a result I need to create a json web token which contains the following information: username, mycompany, and expiration date. In the JWT standard there are reserved claims such as issuer (iss). For my information I was wondering what the best practice is to store my information? I was originally thinking of setting iss = 'mycompany.com', sub = 'myusername', exp = 'whenever', but looking at the documentation from jwt.com (http://jwt.io/introduction/) I see they store the username inside of the payload. Is there reasons for this? If so what are they and would my implementation be wrong then?
sub is just a predefined claim.
As stated in your link, this is for "interoperability". If you do not need to exchange your JWT with other systems, now or in the future then you can use private claims (e.g.
name). If you are using
sub then all systems that are receiving this token must interpret it the same (that is
sub means username and nothing else).
Note that reserved claims are also stored within the payload.