{"id":153,"date":"2020-05-22T16:05:22","date_gmt":"2020-05-22T16:05:22","guid":{"rendered":"https:\/\/shreyapohekar.com\/blogs\/?p=153"},"modified":"2022-02-09T18:54:57","modified_gmt":"2022-02-09T18:54:57","slug":"the-concepts-of-jwt","status":"publish","type":"post","link":"https:\/\/shreyapohekar.com\/blogs\/the-concepts-of-jwt\/","title":{"rendered":"The basic concepts of JWT"},"content":{"rendered":"\n
Nowadays JWTs are widely used as an authorization standard and allows for secure information transmission. There are a lot of features that make JWT the first choice to implement.So let’s dive into the blog post to uncover the basic terminologies of JWT, learn to build JWT from scratch and know about its working.<\/p>\n\n\n\n
What is JWT??<\/h3>\n\n\n\n
It stands for JSON Web Tokens<\/strong>. JWTs are open, industry-standard (RFC 7519) for representing trusts between the 2 parties. By trust, it is implied that there establishes a secure transfer of information between the 2 communicating parties. The information sent is digitally signed that keeps its integrity preserved. Lets learn more about its features that makes it popular.<\/p>\n\n\n\n
Features of JWT<\/h3>\n\n\n\n
Compact<\/strong> : The compact size of the jwt enables it to be sent via URL, POST request, HTTP header<\/strong>. The compactness also leverages high-speed transmission. Because of less overheads, Single sign-on widely uses jwt.<\/p>\n\n\n\n
Self- Contained<\/strong>: JWT contains information about the user (will be discussed later in the post). So once a valid user is identified, the token is used to any further identification therefore removing the need to query the database again and again.<\/p>\n\n\n\n
Structure of JSON Web Tokens<\/h3>\n\n\n\n
JWT is composed of 3 parts: \nHeader \nPayload \nSignature<\/p>\n\n\n\n
Header forms the first part of the token that contains the algorithm used for signing. HMAC SHA256 <\/strong>and RSA<\/strong> are some of the popularly used algorithms. Also, it holds the type of the token type. It is structured in json that is further base64 encoded<\/strong>.<\/p>\n\n\n\n
JWT can be distinguished as a JWS<\/strong>[ JSON Web Signature] or JWE<\/strong>[JSON Web Encryption]. If the value of alg (in the header) represents a signature algorithm, the JWT is a JWS; if it represents an encryption algorithm, the JWT is a JWE.<\/p>\n\n\n\n
If you are wondering whats the difference btw JWS and JWE, lets make it clearer.<\/p>\n\n\n\n
Signing is used in the token so that no one can tamper the data being communicated. Although the dilemma is, sensitive information can be sent if the token is just signed (as the base64 can be easily decoded). \nSo if sensitive information is transferred as a part of token, a layer of security can be added by encrypting the token. That makes a JWE. <\/p>\n\n\n\n
Hope you got is clear now! <\/p>\n\n\n\n
Heading towards the format, let\u2019s see how it looks like:<\/p>\n\n\n\n
Note:<\/strong> As the header and payload are readable, it is strongly advised to not to stuff in any sensitive information unless the jwt is encrypted. <\/p>\n\n\n\n
Signature<\/p>\n\n\n\n
Signatures verifies the identity of the sender and also endures that the sent data is not tempered with.This part basically takes in base64 encode header, base64 encoded payload, a secret, and the signing algo as the part of the header. All the 4 elements are combined to create a signature.<\/p>\n\n\n\n
Note<\/strong>: It is optional to create a signature, but its recommended. If you omit the signature, there jwt will contain only 2 parts (header and payload) and will be of the form (xxxxxxxxxx.yyyyyyyyyyyyy), that can be easily malformed over the transit.<\/p>\n\n\n\n
On Combining the 3 components, here\u2019s what we get<\/p>\n\n\n\n
![\"\"\/](\"https:\/\/lh6.googleusercontent.com\/Yosaz6zkLroC6sJ81gJbMdo1wO3PVUvTzkfCLv9bOmUY2rBtn1sZD4RRRARzl-roF2WL36NntiNJR0U5ld2QWZeFyGoM-fZ05WduSztFhfQ4yynzlwZbk_oMj0Ug70j0OKg81jne\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/lh6.googleusercontent.com\/QgIyX-ir6s32AzOCxednl48zrdfeen45tstT6qWHfY_HD42mVlXREjvs8cRO23xfAEYIOmzhS7y0m_NLQEaCy9OeV-jwpEqnUp_Ip3slLVcDOWQq5df2fd6AYz_usVhoJzh2uA4B\")