title: Hashing and Encrypting JWT Token
body: <p>I went through different post here, I am now more confused about how to implement security for tokens. . I currently implemented an authentication serivce (MVC4 + webAPIs) and a relying party (MVC4 app). Relying party (RP) redirects client to Authentication service (AS). AS creates a token, gives it to client. Client gives it to RP. RP adds more claims etc.
  THis is what I want to do for securing the token:
  HashingToken the token using HMAC SHA 256. How can I share the key between AS and RP? Do I have to sign it and add it in the payload and encrypt?</p>
  
  <ul>
  <li>I want to encrypt the token using AES/Rijndael algorithm/. Again how
  can I share the key with RP?</li>
  <li>RP will decrypt the token first and decode it with the Algorithm
  specified using the key shared to access the payload (timestamp,
  audience, issues etc).</li>
  <li>I am sliding the token expiry date. there is a field jit which needs
  to be unique to avoid replay attacks.. I am currently filling it with
  GUID.. I am not sure how to validate/use it in RP</li>
  </ul>
  
  <p>I am currently sharing symmetric keys for hashing &amp; encryption between AS and RP. </p>
  
  <p>I am working on security for the first time.. although I have gone through multiple posts, I am yet to completely understand, and little confused after reading many posts. If someone can help..</p>