JSON Web Token basics

A JSON Web Token (JWT) is an internet standard for representing claims securely between two parties. JWTs contain three parts: the *header*, the *payload*, and the *signature*. They are joined together by `.` to create a JWT like: `aaaaaa.bbbbb.ccccc`.

Example JWT

Decoded

Header

{
  "alg": "HS256",
  "type": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Signature

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  your-256-bit-secret
)

Encoded

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

When to use a JWT?

– Authorization – After a user logs in the server returns a JWT. The user includes the JWT in each additional request to authorize their requests. JWT tokens are commonly used in Single Sign On setups because it can prevent CORS issues.