Understanding JSON Web Tokens (JWTs) in Web Applications

JSON Web Tokens (JWTs)

• JSON Web Tokens (JWTs) are self-contained JSON objects that securely transmit information between two parties.
• JWTs are digitally signed using a secret or a public/private key pair.

Components of a JWT

• A JWT is made up of three components: Header, Payload, and Signature.

JWT Header

• The JWT header contains the type of the token and the signing algorithm that will be used.
• The type of the token is always "JWT".
• The signing algorithm might vary, with common algorithms including HMAC-SHA256, RSA with SHA-256, and ECDSA with SHA-256.

JWT Payload

• The JWT payload contains claims about an entity.
• There are three types of claims: Registered Claims, Public Claims, and Private Claims.
• Registered Claims are predefined claim types that anyone can use in a JWT.
• Public Claims are custom claim types that are created by a developer and can be used publicly.
• Private Claims are custom claim types that are not registered or public.

JWT Signature

• The JWT signature is used to verify that the JWT wasn't tampered with or changed.
• The signature is created by taking the encoded header, the encoded payload, a secret, and using the hashing algorithm to create a hash.

Using a JWT

• A JWT is properly stored in a secure location, such as a HTTP-only cookie.
• The user logs in to a website, and their information is sent to the server.
• The server creates a JWT with a secret and returns it to the browser.
• The user makes another request, and the browser sends the JWT back to the server in the Authorization header using the Bearer schema.

Advantages of JWTs

• JWTs are used for authorization and information exchange.
• They are small, scale well, and are easier for mobile devices to process.
• Parsing JSON is easier than some alternatives like XML or SAML.

Disadvantages of JWTs

• A mix of a public and private key-pair adds security, but can also add complexity.
• Sensitive information, like passwords or Social Security Numbers, should not be stored client-side, even if it is encoded.

JSON Web Tokens (JWTs)

• JSON Web Tokens (JWTs) are self-contained JSON objects that securely transmit information between two parties.
• JWTs are digitally signed using a secret or a public/private key pair.

Components of a JWT

• A JWT is made up of three components: Header, Payload, and Signature.

JWT Header

• The JWT header contains the type of the token and the signing algorithm that will be used.
• The type of the token is always "JWT".
• The signing algorithm might vary, with common algorithms including HMAC-SHA256, RSA with SHA-256, and ECDSA with SHA-256.

JWT Payload

• The JWT payload contains claims about an entity.
• There are three types of claims: Registered Claims, Public Claims, and Private Claims.
• Registered Claims are predefined claim types that anyone can use in a JWT.
• Public Claims are custom claim types that are created by a developer and can be used publicly.
• Private Claims are custom claim types that are not registered or public.

JWT Signature

• The JWT signature is used to verify that the JWT wasn't tampered with or changed.
• The signature is created by taking the encoded header, the encoded payload, a secret, and using the hashing algorithm to create a hash.

Using a JWT

• A JWT is properly stored in a secure location, such as a HTTP-only cookie.
• The user logs in to a website, and their information is sent to the server.
• The server creates a JWT with a secret and returns it to the browser.
• The user makes another request, and the browser sends the JWT back to the server in the Authorization header using the Bearer schema.

Advantages of JWTs

• JWTs are used for authorization and information exchange.
• They are small, scale well, and are easier for mobile devices to process.
• Parsing JSON is easier than some alternatives like XML or SAML.

Disadvantages of JWTs

• A mix of a public and private key-pair adds security, but can also add complexity.
• Sensitive information, like passwords or Social Security Numbers, should not be stored client-side, even if it is encoded.