Say that we have an authentication system that generates JWT to authenticate users to other systems. This JWT contains an inner token that can be made by multiple IDP's. The signature of this JWT is always verified before it is used to authenticate. The JWT is only as short-lived as the inner token, but the inner token can be JWT itself.
I want to know what potential security problems there are if the inner JWT token is never verified, but instead, we depend on HTTPS security.
In the authorization code flow in OAUTH 2.0, you exchange an access token for the id token and access token of a user at an API endpoint. The next step is to validate these tokens on validity. The public keys are retrieved and used to verify the tokens to be valid. Again, from the same endpoint.
The JWT token will immediately be wrapped in a new JWT Token before they are transported outside a circle of trust. So they can not be modified.
But if those endpoints are on an HTTPS endpoint what is the added value of verifying the tokens? If there is a man-in-the-middle, the attacker also has control of the endpoint exposing the public keys.
The inner token's signature is not verified during authentication of the outer token.
