JWT tokens can be decoded and all the information can be read as json format, for example:
The first part is header:
Second part is Payload:
"name": "John Doe",
The last part is the signature that created as:
//In our example, the algorithm is (HS256)
signature = algorithm(hash of (header + payload), secret)
Now, its the key that only hidden inside the signature of the token, then, we get into conclusion that:
- The KEY shall be kept in secure place and must not be revealed to anyone.
- IF JWT token used for authentication, it must be used over SSL/TLS.
- JWT Token shall not be trusted without
signature validation with secret key.
- ISSUER of JWT token must not put sensitive information inside JWT token in case that only signing of the information used with JWT.
1) How do you handle a situation with a compromised token secret which is
shared between a client and the server?
use SSL/TLS (Secure connection) and expire each token according to your login system. JWT token must be used as permanent, each time user logged in create JWT token.
2) Do you logout all your clients and define a new token secret for
future requests? (that would be a bad experience)
IF your secret key compromised, you have to create new secret key definitely and renew active sessions by issuing log-out and force the system re-authenticate all active users.