self contained - How can JWT be verified outside the authorization server -

recently, i'm trying implement oauth2.0 server using json web token (jwt) access token. i'm confused self-contained feature of jwt. notice jwt can verified anywhere, not mandatorily in authorization server because self-contained. how feature work? claims should included in jwt in order realize self-contained feature?

another question that, if jwt stateless, means server should not store jwt. how jwt verified? can't forged?

i'm rookie in field, wish me out:)

jwt contains claims can signed, encrypted or both. these operations performed using cryptographic keys. keys can symmetric (e.g. octet keys) asymmetric (e.g. private/public key pairs such rsa or ec keys).

when want verify jwt (i.e. jws), have perform following steps:

• check header (algorithm supported, critical claims in payload , value understood).
• check claims (especially exp, iat, nbf, aud).
• check signature.

to check signature, need key and, depending on algorithm, key can be

• the symmetric key
• the public key if asymmetric

when want allow third party applications verify jwt, use asymmetric keys , share public key third parties. public keys cannot used sign, third parties cannot forge valid token custom claims.

the way share keys you. common way provide url applications retrieve them (e.g. google keys @ https://www.googleapis.com/oauth2/v3/certs).