Using JWT's for API authentication

[NotionCommotion]

I am currently doing the following but wish to change to using JWTs.

• A webserver is running some CRM system which has its own authentication system and browsers can access public routes without logging and but must log on first to access private routes.
• All the routes on the webserver which are prefixed by "api" will be forwarded to specific REST API along with an "account" GUID in the header and the user's ID if it exists.
• For the routes that require a user to be logged in, the webserver will first check if a session exists, and if not make a preliminary GET request to the REST API which includes the GUID as well as the user's ID and encrypted password (both based on the webserver's CRM DB) in the URL.  Not sure whether anything is possible by including the hashed password and am currently not doing anything with it.  The REST API queries the DB using the GUID and webserver's user ID and returns the REST API's users ID and the webserver stores it in a session.
• The REST API receives the GUID and potentially the REST API's user ID and queries the DB to retrieve the account and potentially user before executing the route, and returns the response to the webserver which it returns it to the browser.

The new approach might be something like the following:

• Before the webserver forwards any request to the REST API, it checks if a session is set, and if not performs a GET request to the REST API along with the GUID and if known user's credentials in the URL and receives a JWT which contains a payload including the account PK, and potentially the user PK, user's access level, etc.
• All future requests include this JWT in the header.
• The REST API no longer queries the DB to get the account ID and user authorized settings as it is provided in the JWT.

A couple of questions:

• What should be done if a non-logged on user first accesses a public route, gets a JWT, and stores it in a session, but then later logs on and accesses a private route?  The webserver thinks it has a valid JWT and will send it but the REST API will then decrypt it and find there is no user it.  One option is for the webserver to use two sessions, but this sounds kludgy.  Or maybe the REST API returns some header which instructs the webserver to re-authenticate, but not sure if even an option, and if so how to cleanly prevent some loop.  Also, would it be necessary to issue a new JWT or can the payload in a JWT be changed?
• Is GET appropriate for requesting the JWT's or should I use some other method?
• Is it appropriate to include the user's access level in the JWT payload?  Will one need to wait until the JWT has expired before their access level changes?
• Any ideas how to deal with using the user's password on the CRM to also authenticate on the REST API?  The GUID is probably secret enough for the application and if an issue, can just use the GUID and username.
• Am I going down an reasonable path and anything else obvious I should be considering?

Thanks!

[NotionCommotion]

I think I have answers to these two items.  Monitor when users log on and make changes and update the API as appropriate.  Make sense?

• What should be done if a non-logged on user first accesses a public route, gets a JWT, and stores it in a session, but then later logs on and accesses a private route?  The webserver thinks it has a valid JWT and will send it but the REST API will then decrypt it and find there is no user it.  One option is for the webserver to use two sessions, but this sounds kludgy.  Or maybe the REST API returns some header which instructs the webserver to re-authenticate, but not sure if even an option, and if so how to cleanly prevent some loop.  Also, would it be necessary to issue a new JWT or can the payload in a JWT be changed?
• Any ideas how to deal with using the user's password on the CRM to also authenticate on the REST API?  The GUID is probably secret enough for the application and if an issue, can just use the GUID and username.

Still would appreciate advice on the following (as well as you feel my above comment is wrong).

 

• Is GET appropriate for requesting the JWT's or should I use some other method?
• Is it appropriate to include the user's access level in the JWT payload?  Will one need to wait until the JWT has expired before their access level changes?
• Am I going down an reasonable path and anything else obvious I should be considering?