Should I decode the JWT on the client side?

Question

I'm building an android app and planning to use Json Web Tokens (JWT) for authentication.

Once my server returns a response with the generated token, does it make sense to decode the token on the client side to read the payload or should I use the token strictly as an authentication mechanism and make a second request to get the user's info?

Thanks

Answer 1

As most things, it depends. If you control the authorization server (i.e. it's your API you are calling), I don't really see any issues with reading the contents of the token at the client side.

If you are calling a 3rd party API and authenticating against a server you do not control, I would not take a dependency on the contents of the JWT token. The 3rd party may decide to change the claims in the token or even start encrypting the token.