title: What to validate 'iat' and 'sub' claims of a JWT against?
body: <p>I am writing an SSO authentication server in Node.js and Express, using JWT for authentication. I've been reading up from articles from sources like Auth0 on how to better secure my JWTs. I've been able to include and validate most of the standard claims on a token, but I'm wondering what exactly to validate the 'iat' and 'sub' claims against.</p>
  
  <p>For 'iat', when a token is passed to an Express route and that route begins to check the authentication status of a user before performing any sensitive operations, what is the best practice for providing a value to validate this claim against? My best guess was to pull out the userId from the token, before verifying the signature, and then comparing it to an 'iat' value which would be stored in the users table, but this doesn't seem right.</p>
  
  <p>For 'sub', with a stateless server, how is the app supposed to know which user's 'sub' claim to expect and validate against, if the app gets its user information from the validated token itself?</p>
  
  <p>Or am I understanding these use cases incorrectly? The purpose of this server is to provide authentication for the content inside this app itself, as well as other apps.</p>