I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization.
I've been thinking about what would be the best place to store the secret key and i've come up with the idea that i'd simply generate a random key when starting the server (and would not persist it anywhere) and use that to generate/verify the tokens.
I think this approach would be quite simple to implement and more secure than persisting the key.
The only downside i see is the issued tokens would become invalid on server restarts.
I haven't really seen this anywhere, so i'm not sure if it's a stupid idea or not.
Any insight would be appreciated.