Thread by @JoseHaroPeralta

💡𝐖𝐡𝐚𝐭 𝐚𝐫𝐞 𝐉𝐖𝐓𝐬?💡

If you work with APIs, you've probably come across JWTs. JWT stands for 𝐉𝐒𝐎𝐍 𝐖𝐞𝐛 𝐓𝐨𝐤𝐞𝐧, and it's a JSON document that contains information about a user. We call the properties of a JWT claims.

🧵🧵🧵🧵
1/

#API #jwt #auth #WebSecurity

There're two types of JWTs:

👉 𝐈𝐃 𝐭𝐨𝐤𝐞𝐧𝐬 are tokens carrying user-identifying data like their name and email. You should 𝐍𝐄𝐕𝐄𝐑 use an ID token to validate access to an API.

👉 𝐀𝐜𝐜𝐞𝐬𝐬 𝐭𝐨𝐤𝐞𝐧𝐬 are tokens with claims about the right to access an API.

2/

We use access tokens to validate access to an API.

A JWT has three components: header, payload, and signature

👇

🔸 𝐇𝐞𝐚𝐝𝐞𝐫: it identifies the document as a JWT and contains metadata, such as the algorithm and the key ID used to sign the token.

3/

🔸 𝐏𝐚𝐲𝐥𝐨𝐚𝐝: the set of claims that a) identify a user in ID tokens or b) claim the user's access to the API (access tokens).

🔸 𝐒𝐢𝐠𝐧𝐚𝐭𝐮𝐫𝐞: a signature produced by combining the header and the payload. The signature verifies that the JWT is legit.

4/

𝐉𝐖𝐓 𝐜𝐥𝐚𝐢𝐦𝐬

The standard claims of an access token are:

- 𝐢𝐬𝐬 (issuer): identifies the authorization server that issued the JWT.
- 𝐬𝐮𝐛 (subject): identifies the subject of the JWT, i.e. the user sending the request to the server.

5/

- 𝐚𝐮𝐝 (audience): the JWT's recipient (aka the API server).
- 𝐞𝐱𝐩 (expiration time): when the JWT expires.
- 𝐧𝐛𝐟 (not before time): time before which the JWT mustn't be accepted.
- 𝐢𝐚𝐭 (issued at time): when the JWT was issued.
- 𝐣𝐭𝐢 (JWT ID): a JWT unique ID.

6/

𝐉𝐖𝐓 𝐬𝐢𝐠𝐧𝐢𝐧𝐠 𝐚𝐥𝐠𝐨𝐫𝐢𝐭𝐡𝐦𝐬

JWTs are signed using the HS256 and the RS256 algorithms:

🔶 𝐇𝐒𝟐𝟓𝟔 uses a secret to encrypt the token.

🔶 𝐑𝐒𝟐𝟓𝟔 uses a private/public key.

We use this info to apply the right algorithm to verify the token’s signature.

7/