Search code examples
jwtjson-web-token

Create JWT on implementation A and verify on implementation B - is that possible?

more specific: can I use jwt .net implementation to create a token and use jwt node.js implementation to verify the token?

Solution

  • The implementation details does not affect to the format or content of JWT, so you can perfectly use .net (A) to generate and node.js (B)to verify.

    For B to be able to verify the token, use a RSA asymmetric key pair, public and private. A signs with the private key and B verifiew with the public.

    It would be possible to share a HMAC symmetric key between A and B. But then it is needed to consider the security issues of having the key in both systems and how to synchronize them.