Class 13

JSON Web Token Structure

• JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

scenarios where JSON Web Tokens are useful:

• Authorization • Information Exchange

JSON Web Tokens consist of three parts separated by dots (.), which are:

1. Header – which usually consists of 2 parts:

• {
• "alg": "HS256",
• "typ": "JWT"
• }

2. Payload – Which are statements about an entity (typically, the user) and additional data.

• Registered claims: These are a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims. Some of them are: iss (issuer), exp (expiration time), sub (subject), aud(audience), and others.
• Public claims: These can be defined at will by those using JWTs. But to avoid collisions they should be defined in the IANA JSON Web Token Registry or be defined as a URI that contains a collision resistant namespace.
• Private claims: These are the custom claims created to share information between parties that agree on using them and are neither registered or publicclaims.
• {
• ”sub": "1234567890",
• "name": "John Doe",
• "admin": true
• }

3. Signature - is used to verify the message wasn't changed along the way, and, in the case of tokens signed with a private key, it can also verify that the sender of the JWT is who it says it is.