JWT Common Practices

Question

I had a few questions in regards to certain practices used by JWT developers. I'm relatively new to both encryption and JWTs and the context given is for developing a system on nodejs.

1. How should verification work? Should I look at the JWT's signature section and verify with the private key each time? Or should I store the token in a No-SQL database and see if it contains it for verification (checking expiration dates too)?

2. How many bits should each secret key be? Is 2048 too much? What's the 'good medium'?

3. Is RSA with the HMAC SHA256 signing method okay? What's the best method for key creation? Should keys be generated on multiple occasions (ie. per server startup)? Or is having it static fine?

Answer 1

1. How should verification work? - JWT documentation are your friend.
2. Should I look at the JWT's signature section and verify with the private key each time? - https://scotch.io/tutorials/the-anatomy-of-a-json-web-token
3. should I store the token in a No-SQL? - NO, there's no need if you are able to decode the token that mean the token is valid.
4. secret key be? it's depends the bigger the key the slower your api so its a trade off (remember you need to decode the token on every request)
5. Is RSA with the HMAC SHA256...? Most people using HS256,

I'm recommending for you to check out this url

Hope it helps,