Mastering JSON Web Tokens (JWT): Structure, Claims & Security

JSON Web Tokens (JWT), defined in **RFC 7519**, are an open, industry-standard method for securely representing claims between two parties. They are widely used for stateless authentication and API authorization.

1. The Anatomy of a JWT A compact JWT consists of three parts separated by dots (`.`): 1. **Header:** Contains the token type (`JWT`) and signing algorithm (`HS256`, `RS256`, `ES256`). 2. **Payload:** Contains the claims (statements about an entity, such as user ID, roles, and expiration). 3. **Signature:** Generated by taking the encoded header, encoded payload, a secret or private key, and passing them through the specified algorithm.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

2. Critical Security Pitfalls - **Never Store Secrets in the Payload:** JWT payloads are Base64URL-encoded, NOT encrypted. Anyone who intercepts the token can decode the payload instantly. - **The `"alg": "none"` Vulnerability:** Older libraries improperly accepted unsigned tokens if the attacker set the algorithm header to `none`. Ensure your backend enforces strict algorithm verification. - **Symmetric (HS256) vs Asymmetric (RS256):** For microservices where multiple consumers verify tokens, use asymmetric keys (RS256/ES256) so only the auth server possesses the private signing key.