I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which.
The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token. All further calls to the endpoint require an Authorization header of type bearer, and the endpoint supports renewal of this token, as long the token is not expired, for what it seems to be an infinite amount of time. (which in itself isn't great). The server-side seems to validate the signature of this token in every request.
In the past having used only RSA tokens, we always shared with clients the public key so they could verify the signature of the token. However since this api only supports HS256, this is not possible.
What security risks would a client not verifying the signature incur for the client side? An obvious one is accessing cached data within the screens. But would there be more serious ones? Thanks in advance.