What is Json Web Token? JWT Token Explained

Code with Julian

7 Nov 202107:32

Summary

TLDRThe video explains authentication and authorization processes to control access to web resources. It then introduces JSON Web Tokens (JWTs) - an industry standard for securely representing user identity and access claims. JWTs have three components - a header, payload, and signature. The header and payload contain metadata, while the signature verifies integrity. When a user logs in, the server returns a signed JWT containing the user's claims to the client. The client stores the JWT and includes it in future requests. The server validates the JWT signature and claims on each request before allowing access.

Takeaways

📝 JWTs allow secure representation of claims between parties
🔑 They contain 3 components: header, payload & signature
👤 Header & payload are encoded & signature verifies integrity
🔐 JWTs used for authentication & authorization
🛂 Server issues JWT when user logs in, client stores it
⚖️ JWT sent with subsequent requests to access resources
✅ Server validates JWT to allow/deny access to resources
😄 Custom claims can share info between agreed parties
⏱ JWT expiration times prevent reuse if compromised
👍 JWT becoming industry standard for authentication

Q & A

What is the difference between authentication and authorization?
-Authentication is the process of verifying the identity of a user. Authorization is the process of granting access to specific resources based on certain rules and policies.
What are the three main components of a JSON Web Token (JWT)?
-The three main components of a JWT are: the header, the payload, and the signature.
What kind of information is stored in the header and payload of a JWT?
-The header holds the token type and signing algorithm information. The payload holds claims about the user such as ID, role, or other custom claims.
What are the three types of claims that can be included in a JWT payload?
-The three types of claims are: registered claims, public claims, and private claims.
What is the purpose of the signature component in a JWT?
-The signature is used to verify that the JWT message was not tampered with along the way. It encodes the header, payload, and a secret key.
Where is the JWT token stored on the client side?
-The JWT token is most often stored in a session cookie inside the web browser on the client side.
How does the server validate incoming requests that contain a JWT?
-The server validates JWTs from incoming requests by decoding the token and checking factors like expiry, signature validity, and claims.
What does the server respond with if JWT validation fails?
-If JWT validation fails, the server responds with an unauthorized or unauthenticated error status code to deny access.
Why are JWTs useful for authentication?
-JWTs allow stateless authentication by encoding user data and credentials into a compact token that can be easily passed in requests for authorization.
When is a new JWT issued to the client?
-A new JWT is issued to the client upon successful login or authentication with the server.

Outlines

00:00

📝 What is JSON Web Token and How Does It Work for Authentication

This paragraph provides an introduction to authentication, authorization, and JSON web tokens. It explains that authentication verifies user identity while authorization controls access to resources. JSON web tokens are an industry standard for securely representing claims between parties, consisting of a header, payload, and signature.

05:01

❗️ How JSON Web Tokens Work in Practice for Login and Data Access

This paragraph illustrates how JSON web tokens work in practice using a web client-server example. It shows the flow of the user logging in, the server issuing a JWT, the client storing and sending the JWT with requests, and the server validating the JWT to allow or deny access.

Mindmap

Keywords

💡authentication

Authentication is the process of verifying the identity of a user or process. It is an important concept related to accessing protected resources. As explained in the video, an ecommerce site uses authentication to prevent unregistered users from accessing seller dashboards. Only sellers who log in with valid credentials are authenticated and allowed access.

💡authorization

Authorization is the process of granting access to specific resources based on rules and policies. It determines what an authenticated user is allowed to access. As an example from the video, on Amazon a buyer is only authorized to access buyer related pages while a seller is authorized to access seller dashboards, based on their user roles.

💡JSON Web Token (JWT)

A JSON Web Token is an industry standard method for securely representing claims between parties. As explained in the video, it has become popular for implementing authentication and authorization in web and mobile applications. Some key properties are that it is self-contained, can be easily passed in requests, and integrity can be verified.

💡header

The header is one of the three components of a JWT. As stated in the video, it contains metadata like the type of token and the signing algorithm used. For example - {"typ": "JWT", "alg": "HS256"}.

💡payload

The payload is the second component of a JWT. As explained in the video, it contains the claims which are statements about the entity like user ID, role etc. There are three types - registered, public and private claims.

💡signature

The third component of a JWT. It is constructed using the encoded header, encoded payload, and the secret key. As stated in the video, it allows verifying that the message has not been altered in transit.

💡registered claims

These are standardized recommended claims as part of the JWT specification. Some examples mentioned in video are iss (issuer), exp (expiration time) and sub (subject).

💡public claims

Custom claims defined for a specific implementation, as stated in video. Care should be taken to avoid collision with registered and private claims.

💡private claims

Custom claims shared between two parties, according to the video. For example, security roles for a user authorization.

💡sign-in algorithm

The algorithm specified in JWT header to encrypt/decrypt the signature component. As per video this provides integrity that token has not been changed in transit. Example HS256.

Highlights

Authentication verifies user identity, authorization gives access to resources based on rules

JSON Web Token has header with token type and algorithm, payload with claims, and signature to verify integrity

Registered claims like ISS and EXP are standard, public claims are custom, private claims are for parties to share info

Signature encodes header and payload with secret key to detect tampering

When user logs in, server issues JWT with claims, browser stores it, then sends it with subsequent requests

On future requests, server validates JWT token before allowing access to resources

If JWT valid, server responds with data, if not valid responds with unauthorized error

JWT allows stateless authentication since token contains all the user info needed

Registered claims like ISS and EXP follow standard, avoid collisions with public/private claims

Private claims shared between agreeing parties like user role or ID

JSON Web Tokens became an industry standard for secure claims between parties

JWT payload holds claims, which are pieces of info like ISS, EXP, and SUB

Authorization gives access to resources based on user role assigned during registration

Amazon checks user role to determine if they can access order data or seller dashboard

JWT allows securely transmitting user identity and privileges for access control