JSON Web Token (JWT)
JSON Web Tokens (JWT)
JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.
JWT are widely uses in Authentication and Information Exchange.
Authentication: Once the user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token.
Information Exchange: Using JWT to securely transmitting information between parties, because JWT tokencan be signed. For example using a RSA public/private key pair, issue a siged JWT with private key, and verify the signed JWT with public key.
JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
JWTs consist of three parts separated by dots (.), which are:
Header
Payload
Signature
For example, a JWT will be looks like {header}.{payload}.{signature}
Header
The header consists of two parts:
hashing algorithm such as HMAC SHA256 or RSA.
token type
SHA256 Example
RSA Example
Payload
Standard Payload Claims
These are some Registered Claim Names of the JSON Web Token. These claims is not mandatory but useful at starting point:
iss: The issuer of the token
sub: The subject of the token
aud: The audience of the token
exp: JWT expiration time defined in Unix time
nbf: "Not before" time that identifies the time before which the JWT must not be accepted for processing
iat: “Issued at” time, in Unix time, at which the token was issued
jti: JWT ID claim provides a unique identifier for the JWT
Signature
Security
It is critical to use TLS/SSL in conjunction with JWT, to prevent man-in-the-middle attacks. In most cases, this will be sufficient to encrypt the JWT payload if it contains sensitive information. You can also encryot the JWT playload using the JWE specification for addition layer of protection.
Generate RSA Public/Private Key Pair
Command to generate key pairs with ssh-keygen in Windows
Example in c:\temp\ directory
Generate public/private key pair with openssl
Reference
Last updated
Was this helpful?