使用JWT - 是否可以通过主题作为电子邮件来验证用户？

Question

I'm new to authentication, and just trying out JWT authentication on a small express app.

I've got a user authentication setup using JWTs, and I'm using the subject as the user's email.

Is this a good practice?

If I decode the JWT on jwt.io, I see:

{
  "sub": "test_user_3@test.com",
  "iat": 1489963760,
  "exp": 1490568560
}

Is that how it is supposed to work?

Answer 1

The sub claim must be unique. Since email addresses are unique, it is a reasonable choice for the claim.

See RFC7519

4.1.2. "sub" (Subject) Claim

The "sub" (subject) claim identifies the principal that is the subject of the JWT. The claims in a JWT are normally statements about the subject. The subject value MUST either be scoped to be locally unique in the context of the issuer or be globally unique. The processing of this claim is generally application specific.

Ensure two users do not register theirselves with the same email address, for example using a generic email like info@test.com