I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will generate a JWT (probably going with a 30-minute expiry, at least to start with).
If they attempt to request authenticated resources, they will need the JWT stored as a bearer token in their HTTP auth header. When this happens, I'll verify/validate the JWT, and if its good, give them access.
Right now I'm struggling with a particular aspect of the design here and I was wondering what the security best practices dictate in such a situation, and that is: what information can/should I put as "claims" on my JWTs?
I guess to start with, I'm not entirely sure what the underlying intent of a JWT claim is, which might help point me in the right direction.
But basically, with respect to my authorization scheme, I'm wondering if it is a good practice (or not) to not only place something in the JWT that identifies the requester as a principal in the system (identification), but also to place claims on that token regarding access control; meaning, do I put a list of all my user's roles, ACLs, etc. on a JWT claim?
Beyond authorization-related data, what other information do you typically see (correctly) added to a JWT in the form of claims? Thanks in advance for any and all help!