title: JWT signature's verification at resource-server side
body: <p>According to <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/docs/oauth2.md#jwt-tokens" rel="nofollow">this</a> and <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/docs/oauth2.md#resource-server-configuration" rel="nofollow">this</a> there are two ways to validate the JWT token: </p>
  
  <ol>
  <li>Using <code>RemoteTokenServices</code> which basically calls <code>/check_token</code> endpoint of oauth server, retrieves the whole token and compares it</li>
  <li>Expose public key at oauth server and verify the JWT's signature at resource server</li>
  </ol>
  
  <p>At the beginning I tried the first way but since I use custom token converter which hits the database every time token being generated, I decided to switch to signature verification at resource side - didn't want to get an additional database call per every client request.</p>
  
  <p>After some investigation I realized that <code>ResourceServerTokenServices</code> (interface describes token retrieval, conversion and generation a valid <code>OAuth2Authentication</code> object) has only two default implementations: <code>DefaultTokenServices</code> which is primary used in case of oauth and resource servers are parts of the same application and <code>RemoteTokenServices</code> which was described in first approach.</p>
  
  <p>So the main question is whether <code>spring-oauth2</code> really hasn't default implementation of JWT signature verification or I just couldn't find one?</p>