මොනවද මේ JWT කියන්නෙ ?

[Shaavi]

“JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.”

When to use JWT?

• Authorization: This is the most common use of jwt. Everytime a user is logged in to the system, a token is generated to the subsequent user. This permits the user to have access to use the routes, services, and resources whenever he needs.

• Information Exchange: JWts are a great way of securely transmitting data between two parties. As the jwts can be signed, for example using public/private keys of each user it is possible to identify whether the senders are people who they say they are. As the signature is calculated using header and a payload it is possible to verify that the content hasn't been tampered with.

What is the JWT structure?

JWT consist of three parts separated by dots (.), which are:

• Header
• Payload
• Signature

Therefore, a JWT typically looks like the following.
header.payload.signature

Header

Headers consist of type of token which is JWT, and the hashing algorithm such as HS256, HMAC, SHA256 or RSA.

{
  "alg": "HS256",
  "typ": "JWT"
}

Then, the above JSON is Base64Url encoded to form the first part of the JWT.

Payload

Payload contains claims which are the information about the entity

The JWT specification defines seven claims that can be included in a token. The registered name claims are:

• iss
• sub
• aud
• exp
• nbf
• iat
• Jti

You can also use private name claims which is used to convey identity related info such as name or category. When naming these, it is necessary to avoid name collisions because public and private claims are not registered.

An example of payload could be:

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
}

The payload is then Base64Url encoded to form the second part of the JSON Web Token.

Signature

This is made using the encoded headeer, encoded payload, secret, the algorithm specified in the header, and sign.

The below signature is created using the HMAC SHA256 algorithm.

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

You can use https://jwt.io/ whenever you want to check jwt tokens and see the connection between the header, payload, and the signature.

[Nubelle]

Thanks bro

[root]

good article. thnx bro

[dev_lak]

nice explanation

[lkdev]

thnx bro. come with another good article good luck

[Shaavi]

@Malith thank you

[Shaavi]

@root thanks

[Shaavi]

@dev_lak thanks a lot

[Shaavi]

@lkdev thank you I will

[shehan_s]

Great explanation! Keep it up dude.

[the_inspired_dev]

Like to see more of this kind of articles in Sinhla 😊

[Harsha Sampath]

Thanks මචන්. මේවයේ සින්හල version එකකුත් යනවා නම් පට්ට. අපේ ගොඩක් උන් security මුකුත් නැතුව app හදනව ඔවා දන්නේ නැති නිසා.

[lkdev]

@Harsha-Sampath

Ow godak ma ewage security aththema na

[Ravindu Yasas]

thanks bro!