Role based Rest-API using JWT

Question

I'm implementing a simple Rest-API in java with jax-rs. I use JWT and a ContainerRequestFilter to verify that the user is logged-in.

Now I want to be able to handle different roles. Is it ok to store the user roles in the JWT (claim) and fully trust it to give access or not to an endpoint ?

If not what's the best way to achieve this ?

Thanks for the help

Answer 1

Is it ok to store the user roles in the JWT (claim) and fully trust it to give access or not to an endpoint ?

Yes, that should be fine. As long as you make sure the JWT token is properly signed , you can be assured that no one can make changes to the token and assign themselves high-privilege roles.