The verification flow of json web based token on server side

Question

I am trying to understand the concept of web tokens (json web tokens to be specific). I can't however find any information on how tokens are verified on the server.

A= CLIENT
B= SERVER

The flow:

1) A -> B: Client sends username and password
2) B: Server checks them against DB records and if they match it creates; first, signature using: base64UrlEncode(header).base64Url(payload), #secret# and then token using: signature.payload.secret
3) A <- B: Server sends back token to client
4) A -> B: Client sends request to access certain URL with token in header
5) B: Server decodes header and payload, uses #secret# to create another digital signature and compares it with what was sent in to ensure integrity

If above flow is correct, it begs following questions:

1) Is there a SSL wrapped around it ? If not anyone could hijack the token and send it to server and user impersonate the client
2) In step 5, there is only integrity checked, the payload data decrypted from token is not verified against DB (for example username), should it be verified or once integrity is confirmed we can be certain the token is valid and application can grant access to the client ?
3) Is #secret# only known to server and used only to validate payload was not tampered with ? I'd presume so, otherwise user impersonation could happen.

Answer 1

The flow you described is correct. You have practically answered your own question.

1) Is there a SSL wrapped around it ? If not anyone could hijack the token and send it to server and user impersonate the client

Yes, it is, the token must be protected because is the proof-of-authentication. It should only be interchanged trough a SSL/TLS connection

2) In step 5, there is only integrity checked, the payload data decrypted from token is not verified against DB (for example username), should it be verified or once integrity is confirmed we can be certain the token is valid and application can grant access to the client ?

The token is signed with server's secret key so any alteration will be detected by server and the token would be rejected. If the verification is successful you can use payload safely.

3) Is #secret# only known to server and used only to validate payload was not tampered with ? I'd presume so, otherwise user impersonation could happen

Yes, the secret key must be "secret". If you use a symmetric HMAC key, it used to create and verify tokens,so if you share it, anyone vould create tokens