Json Web Token (JWT)

Once the user is authenticated by identity platform, the server generates a JWT to communicate between the client and server. As server request are stateless, JWT is to confirm the request is send by the same user. Client includes JWT in the header of subsequent request to access the resources.

JWT has three parts Base64 encoded Header, Base64 encoded Payload and Base64 encoded Signature concatenated with a period separator.

  1. Header: This contains two parts type which is JWT and the signature algorithm used.
  2. Payload: This contains claims which are statements about entity.
  3. Signature: This contains a secret, Base64 encoded  header and payload concatenated with a period    separator. Signature algorithm is applied to the generated string.
JWTs can be easily decoded to inspect their content, but the signature should be verified to ensure the integrity of the token. The verification process requires the knowledge of the secret key used to sign the token.


Comments

Popular posts from this blog

Transform values with a stream

Collections Framework

Inspect a collection