I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email. To identify the subject of the JWT, I currently have a claim which stores the user's email in the token. Does that pose a security problem? If so, should I be using a GUID or a hash of the email as an ID?
On the other hand ...
I have a user db where each user's unique ID is their email ...
This make the question interesting because there's already a protected claim for users' ID. The claim
4.1.2. "sub" (Subject) Claim
The "sub" (subject) claim identifies the principal that is the subject of the JWT. The claims in a JWT are normally statements about the subject. The subject value MUST either be scoped to be locally unique in the context of the issuer or be globally unique. The processing of this claim is generally application specific. The "sub" value is a case-sensitive string containing a StringOrURI value. Use of this claim is OPTIONAL.
Maybe, it would be more appropriated to use the claim
sub instead of
Perhaps, nothing stops you from implementing both
Regardless of the claims, from the security standpoint, the main concerns are (or should be) to implement the TLS (https) and to sign/encrypt the token in order to reduce the attack surface fo the authorization process.