The JWT we created has an empty payload so far and carries no meaningful information. And even though it's enough to make sure that the user has been authenticated by simply validating that the token was signed by the server key, we wouldn't be able to know anything about the authenticated user.
Claims allow us to add key-values pairs that we can later retrieve from the token. For example, the GiveNTake application adds the user email as a claim, and then uses it to retrieve the User entity from the database when needed. Here is how the GenerateTokenAsync method can be modified to include all the user claims:
private async Task<JwtSecurityToken> GenerateTokenAsync(User user){ var claims = new List<Claim>() { new Claim(JwtRegisteredClaimNames.Sub, ...
