JSON Web Tokens (JWT)

JSON Web Token (JWT) is a popular standard for Authorization and Information Exchange between parties. For Authorization the Token is used to access services routes and resources following a successful login. Whereas for Information Exchange the token can be used to ensure that the senders are who the claim they are and that the information has not been tempered with.

The following example illustrates how JWT is used for Authorization.

The above example illustrates how a user first call a Authentication server to prove that he has a user account. Once the server has verified that the user exists the JWT is created with the rights of the user. The JWT is then returned to the user application where it is added to a API call to a content server which based on the rights in the JWT returns the requested content.

A JWT consists of three elements.

• Header
• Payload
• Signature

Header
The header is being used as the informative part of the token, hence it often only contains two elements which states what kind of Token you're dealing with and the signing algorithm that is being used in the Token.

Payload
The second part of the token is where the content is stored, such as access rights or user information. It is however important to be aware that even though the token is protected against data tempering the data within is readable by anyone. You should therefore never as a developer of a system using JWT include sensitive data such as passwords or banking information in such token unless it is encrypted.

Signature
The last part of the token is the signature which is the part used to secure that the token and the data of the header or payload has not been tempered with. A signature is created using the algorithm specified in the header which receives a base 64 encoding of the header+payload as input along with a secret(word).


Getting started using JWT following the link below:
https://jwt.io/