{"id":233,"date":"2017-03-31T05:56:47","date_gmt":"2017-03-31T12:56:47","guid":{"rendered":"http:\/\/vinodsr.com\/myblog\/?p=233"},"modified":"2020-04-24T10:08:20","modified_gmt":"2020-04-24T17:08:20","slug":"json-web-tokens-intro","status":"publish","type":"post","link":"https:\/\/vinodsr.com\/myblog\/2017\/03\/json-web-tokens-intro\/","title":{"rendered":"JWT – Security with Simplicity"},"content":{"rendered":"

Reading time : [est_time]<\/span><\/strong><\/p>\n

I<\/span>n today’s world , security is the prime priority.<\/span><\/p>\n

Throughout the evolution of computers, security also evolved from simple password based authentication to multi factor based authentication, from simple text encryption to two key encryption.  The latest in this evolution is JWT (JSON Web Tokens), which handles secure message passing between two clients \/ parties.<\/span><\/p>\n

Why we need JWT ?<\/h1>\n

In a normal token based authentication, a token is granted for a authenticated user. All the subsequent service calls uses this token and identifies the user. The identification process takes place at server where this token is validated against a token store data. Same is the case for a SAML authentication. The idea of JWT is to make this token self contained with out loosing the compact nature. So the identity will also lies with in the token . This will reduce the time to look up in the token store and also makes the program code straight forward.<\/span><\/p>\n

<\/p>\n

How JWT Works ?<\/h1>\n

JWT has got three parts; a header, a payload and a signature separated by a dot(.) .<\/span><\/p>\n

A typical JWT token looks like<\/span><\/p>\n

xxxx.yyyy.zzzz\n\n<header>.<payload>.<signature><\/pre>\n
1. Header<\/span><\/h2>\n
The header consist of two parts. The type of the token which is  JWT and the hashing algorithm used eg: HMAC SHA256 or RSA. This JSON block is base64URL encoded.<\/span><\/p>\n
{ \n \"alg\": \"HS256\",\n \"typ\": \"JWT\" \n}<\/pre>\n
2. Payload<\/span><\/h2>\n
This section contains the information of the user with the associated meta data. The payload can also store relevant information as per the context. It is advised to make it short as possible (avoid using long key values).<\/span><\/p>\n
Like the header the payload is also base64URL encoded.<\/span><\/p>\n
{\n \"name\" : \"Peter\",\n \"id\" : \"S190F34\"\n}<\/pre>\n
3. Signature<\/span><\/h2>\n
To create a signature, take the header and the payload and sign it using the mentioned algorithm with a secret.<\/span><\/p>\n
It will look like this.<\/span><\/p>\n
HMACSHA256(\n  base64UrlEncode(header) + \".\" +\n  base64UrlEncode(payload),\n  secret)<\/pre>\n
Secret can be any string agreed between the two parties. The signature is used to verify the authenticity of the message.<\/span><\/p>\n
Finally the JWT will look like <\/span><\/p>\n
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiUGV0ZXIiLCJpZCI6IlMxOTBGMzQifQ.ZHMsgv28QW3wt3cnyd3pAF3Uzyw0dbzmKF9nZfH9rS8<\/code><\/span><\/p>\n
More details about JWT can be found at https:\/\/jwt.io\/introduction\/<\/a>. You can use the jwt.io debugger <\/a>to generate, decode and verify the tokens.<\/p>\n","protected":false},"excerpt":{"rendered":"
Reading time : [est_time] In today’s world , security is the prime priority. Throughout the evolution of computers, security also evolved from simple password based authentication…<\/p>\n","protected":false},"author":1,"featured_media":318,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-233","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","has-post-thumbnail-archive"],"aioseo_notices":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/posts\/233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/comments?post=233"}],"version-history":[{"count":15,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/posts\/233\/revisions"}],"predecessor-version":[{"id":319,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/posts\/233\/revisions\/319"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/media\/318"}],"wp:attachment":[{"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/media?parent=233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/categories?post=233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vinodsr.com\/myblog\/wp-json\/wp\/v2\/tags?post=233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}