I am trying to implement an authentication/authorization system using JWT for my web application. The clients are provided with a token on the usual JWT format from my server once they present credentials which I check against the database.
The problem that I thought might arise is that from what I know JWT tokens are not encrypted or signed in any way so I might be a victim of MitM where someone is changing the claims in my payload and send a response or just steal data.
I figured out that this could be fixed by signing the JWT token using HMAC or better using RSA private/public key pair but again the RSA public key should have some kind of certificate attached cause the public key could be compromised at some point.
This is when I asked myself: 'Is it really necessary ?'. If I am getting a SSL certificate for all my pages and I communicate my tokens through it should I also sign them at 'application layer' ? Seems to me that I am just getting paranoid thinking that my CA could be compromised and someone could see my JWT tokens while are sent from the server. What are the chances of this happening ? Should I really take the time to develop one extra security layer before SSL where I generate a JWT token secure it with RSA private/public key pair and then send it to the user through an SSL channel ?