How to validate a JWT on a microservice that does not have any information about the user?

Question

JSON Web Token

Hello. I have a question. I am building a microservice architecture. I have a separate authorization service that stores information about the user, JWT is also generated there. Further, the client with the already existing JWT makes a request for some other microservice (for example, a media service), but this service does not have any user information. How should the token be validated in this case? Does each microservice have to make a request through the broker to the authorization service, which will noticeably affect the payload, or is there another solution?

Answer 1

1) Request an authentication server, yes. Cache his responses.
2) Or sign the JWT with the private key of the authentication server. The public key must be known to all services.
3) The authentication server may notify the revocation of the JWT through the MQ server. Of course, each microservice must subscribe to these notifications.