What to store in JWT key

Question

Im newbie in web development and security. Im developing something like a social media. I need to know what store in my JWT token. I think that would be good store user id (primary key from database). This way I could lookup all stuff about the user eg full name, unique username, profile photo, and posts from the token.

Since JWT is easily decoded it won't be insecure save the user id? Someone that stole the token could use the id to run some SQL in my database? Would be better save info about user that is already public like unique username?

Answer 1

This is a deep topic, regarding JWT and security. There is many different ways to store a JWT, such as in Local Storage, Session Storage and in a Cookie. There is advantages and disadvantages to each method, and keep in mind there is no 100% secure way of storing JWTs.You should store the user's id in the JWT and NEVER sensitive information. You can learn more by researching each method of storing JWTs.