JWT Backend Tutorial

Endpoints

1. POST /signup (handled by signup)
2. POST /login (handled by login)
3. GET /protected (handled by protectedEndpoint)

Notes on JWTs

General Info

• JWT stands for JSON Web Token
• JWT is a means of exchanging information between two parties (in payload)
• Digitally signed

Structure of JWT

{Base64 encoded Header}.{Base64 encoded Payload}.{Signature}

• Header contains algorithm and token type , and before encoding looks like

{
  "alg": "HS256",
  "typ": "JWT"
}

• The payload can carry claims, which are user and additional data such as token expiry, etc.
• Three types of claims: Registered, Public, and Private
• Before encoding, an example is

{
  "email": "test@example.com",
  "issuer": "course"
}

• The signature is computer from the header, payload, and a secret
• Signature generated by am algorithm
• Digitally signed using a secret string only known to the developer (cannot be decrypted)