Q:

Why are JWT's secure?

I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding:

When a user logs in, the server will create a JWT the third part of which is a signature that is created using a secret key.
In further calls to the API, the user can include the JWT in the header, and the server will be able to check the signature, again using the secret key. This means that an attacker that has intercepted the JWT cannot change the payload in any way, because if they do, then the signature will not match.

Questions

If an attacker manages to get hold of a JWT, will this not enable them to use the API as if they were the user that had originally authenticated?
I was thinking of including an expiry timestamp in the payload so that the user had to log in occasionally. Is this the correct way of expiring the JWT?

Thank you in advance.

A:

Questions
If an attacker manages to get hold of a JWT, will this not enable them to use the API as if they were the user that had originally authenticated?

Yes. Same thing as if an attacker manages to obtain a users session id. However, this is why you want to limit the lifetime of JWTs.

I was thinking of including an expiry timestamp in the payload so that the user had to log in occasionally. Is this the correct way of expiring the JWT?

Yes. Plus you might want to add a revocation mechanism. This article provides a good introduction on the subject: https://stormpath.com/blog/token-auth-spa/

