title: Does JWT share/store the secret for signing on both the client and server?
body: <p>I am working through some architecture issues in my head related to JWT authentication security and I'm trying to figure out the following:</p>
  
  <ol>
  <li><p>How does JWT securely pass a secret between server and client?</p></li>
  <li><p>Take a look at the below excerpt from from <a href="https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/" rel="nofollow">https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/</a> ....................</p></li>
  </ol>
  
  <blockquote>
    <p>CSRF can be prevented by using synchronized token patterns. This sounds complicated, but all modern web frameworks have support for this.</p>
    
    <p>For example, AngularJS has a solution to validate that the cookie is accessible by only your domain. Straight from AngularJS docs:</p>
    
    <blockquote>
      <p>'When performing XHR requests, the $http service reads a token from a cookie (by default, XSRF-TOKEN) and sets it as an HTTP header (X-XSRF-TOKEN). Since only JavaScript that runs on your domain can read the cookie, your server can be assured that the XHR came from JavaScript running on your domain.
      You can make this CSRF protection stateless by including a xsrfToken JWT claim:'</p>
      
      <p><code>{
      "iss": "http://galaxies.com",
      "exp": 1300819380,
      "scopes": ["explorer", "solar-harvester", "seller"],
      "sub": "tom@andromeda.com",
      "xsrfToken": "d9b9714c-7ac0-42e0-8696-2dae95dbc33e"
      }</code></p>
    </blockquote>
  </blockquote>
  
  <ol start="3">
  <li>How does the client create and send a valid request including the xsrfToken claim unless it can first sign the JWT after including the claim? (This xsrfToken after all is what's supposed to keep EvilBob from forging a request right?)</li>
  </ol>
  
  <p>More details regarding my current understanding of the JWT XSRF process can be found here <a href="http://spring.io/blog/2013/08/21/spring-security-3-2-0-rc1-highlights-csrf-protection/" rel="nofollow">http://spring.io/blog/2013/08/21/spring-security-3-2-0-rc1-highlights-csrf-protection/</a>.</p>