How to validate non authenticated users from a mobile app on a server?
<p><strong>My goal</strong> : Have a mobile app that does not require users to ever sign in. Have these unauthenticated users hit my server. </p>

<p><strong>What I have</strong> : My server is using the AWS API Gateway / AWS Lambda setup. The custom authorizer I used for AWS API Gateway was designed using this <a href="https://aws.amazon.com/jp/blogs/compute/introducing-custom-authorizers-in-amazon-api-gateway/" rel="nofollow">example</a>. I Also pasted the code from this example below <strong>(A)</strong>.</p>

<p><strong>My Question</strong> : From the code block below (A), I get the impression I should use JWT. <strong>How</strong> can I use JWT to validate unauthenticated users when these tokens expire? If JWT is not the best thing to use, what would be?</p>

<p>Thanks!</p>

<p><strong>(A)</strong></p>

<pre><code>var nJwt = require('njwt');
var AWS = require('aws-sdk');
var signingKey = "CiCnRmG+t+ BASE 64 ENCODED ENCRYPTED SIGNING KEY Mk=";

exports.handler = function(event, context) {
   console.log('Client token: ' + event.authorizationToken);
   console.log('Method ARN: ' + event.methodArn);
   var kms = new AWS.KMS();

  var decryptionParams = {
     CiphertextBlob : new Buffer(signingKey, 'base64')
  }

  kms.decrypt(decryptionParams, function(err, data) {
  if (err) {
    console.log(err, err.stack);
    context.fail("Unable to load encryption key");
  } else {
    key = data.Plaintext;

  try {
    verifiedJwt = nJwt.verify(event.authorizationToken, key);
    console.log(verifiedJwt);

    // parse the ARN from the incoming event
    var apiOptions = {};
    var tmp = event.methodArn.split(':');
    var apiGatewayArnTmp = tmp[5].split('/');
    var awsAccountId = tmp[4];
    apiOptions.region = tmp[3];
    apiOptions.restApiId = apiGatewayArnTmp[0];
    apiOptions.stage = apiGatewayArnTmp[1];

    policy = new AuthPolicy(verifiedJwt.body.sub, awsAccountId, apiOptions);

    if (verifiedJwt.body.scope.indexOf("admins") &gt; -1) {
       policy.allowAllMethods();
    } else {
      policy.allowMethod(AuthPolicy.HttpVerb.GET, "*");
      policy.allowMethod(AuthPolicy.HttpVerb.POST, "/users/" + verifiedJwt.body.sub);
    }

    context.succeed(policy.build());

  } catch (ex) {
    console.log(ex, ex.stack);
    context.fail("Unauthorized");
  }
}
});
};
</code></pre>