I'm not sure I have a full understanding of JWT when it comes to the signature. The signature, as I get it, validates to the server that the header/payload that was transfer from the client is legit.
So if I get it right it goes (almost) like this:
Say I'm Allison and I just logged in a server and was successfully authenticated. The server will generate a token (JWT) for which I'm going to use to communicate with the server.
It 'tells' me: use this KEY (example: SERVER_PW_0001) to hash your payload + header and that would be the signature and when I (the server) get your encoded token I will know it is from you because I'll use our secret shared key to hash the payload + header and I expect to get the same signature of yours.
So I'm asking:
After authentication, how does the server transfer the key to the client so only the client can read it?
when the server shares a secret key with a client is it for each unique client?
What is the payload for? if it is exposed out in the open (base64) what info is important to transfer from the client to the server and reverse in the payload/header?
say there's another server (server2) where the client wants to communicate with but without authentication (because it was authenticated already with server1) - how does server2 get the shared_key from server1 [1]: https://jwt.io/