title: JWT Token Storage
body: <p>I have been going through some of my .NET Core2 services and adding some JWT authentication to them to provide some basic security.</p>
  
  <p>I created a new <code>ProvisioningService</code> which has an endpoint that builds a token and returns it:</p>
  
  <pre><code>var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]));
  var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
  
  var token = new JwtSecurityToken(_config["Jwt:Issuer"],
          _config["Jwt:Issuer"],
          claims,
          expires: DateTime.Now.AddMinutes(30),
          signingCredentials: creds);
  
  return new JwtSecurityTokenHandler().WriteToken(token);
  </code></pre>
  
  <p>I altered one of my existing services (which I'll refer to as <code>TestService</code>) by adding <code>AddAuthentication</code> in the <code>StartUp</code>.  The endpoint for this call has the <code>[HttpPost(), Authorize]</code> attributes.  I deployed these changes to my Test server.</p>
  
  <p>When I call <code>TestService/api/updateSomething</code> I am returned a <code>401 Unauthorized</code> as expected.  On my local machine, I create a new token via <code>ProvisioningService/api/buildToken</code> and add the token from the response to my <code>TestService</code> call via the Authorization header.  To my surprise...this worked.  </p>
  
  <p>Why does my <code>TestService</code> (on a completely different server) view a token created on my local machine as a valid token and allow the call to work?  I was expecting this to return the same <code>401</code> because I assumed this token was going to be invalid on my Test server.  My inexperience with JWT is probably showing....but I am not understanding how these tokens are being stored/shared between servers. </p>