java - JWT token encryption and transferring in http get -

i'd validate 1 security approach we'd use. have 2 applications , we'd pass data using jwt token (make redirect 1 pllication + pass sensitive information in token).

for purpose created jwtsigner shared secret , sign claims.

jwtsigner signer = new jwtsigner(secret); return signer.sign(claims); 

as per understanding preferable need additionally encrypt information signing pervent tampering info.

the question whether it's secure enough pass token parameter in url ?

it depends.

if done right, yes, safe -- applications able issue valid tokens. if done wrong, worthless.

how right (tm):

• the payload in jwt not encrypted; can read third parties after base64-decoding. signing prevents tampering, not disclosure.
• jwt has "alg" field can used specify encryption algorithm used. attacker-friendly: not trust contents.
• make immune replay attacks, example using , verifying request counter or time-stamp.
• use strong encryption. public-key encryption has advantage of allowing each endpoint verify other, without knowing other's private key; symmetric encryption option.
• protect secret keys. use different keys testing , deployment, , never check keys source-control.