Search code examples
ruby-on-railsoauth-2.0jwtdoorkeepersatellizer

Doorkeeper JWT validation

I am using the doorkeeper gem with jwt on my rails-api backend and a angularjs frontend (satellizer).

Question 1 Do I need to share JWT sercet key to the frontend (the angularjs app)?

Question 2 How does doorkeeper verify JWT tokens?

Thanks!

Solution

    1. Answer. No, you don't have to share JWT secret key with anybody. Only components that need to know what is "inside" JWT token need to have it.

    2. To my understanding, no. You have to do that by yourself in your controllers. Doorkeeper only checks if token as "string" is valid - expired. It treats it as any other token.