Gaurav Sachdeva

In the world of web development, making sure users are who they say they are is crucial. JSON Web Tokens (JWT) have become a popular way to handle user authentication. In this blog post, we'll explain what JWTs are, how they work, and why they're a good choice for authentication.

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is a compact and self-contained way to securely transmit information between parties as a JSON object. Because it's digitally signed, you can trust the information it contains.

Structure of a JWT

A JWT has three parts separated by dots (.): Header, Payload, and Signature. So, a JWT looks like this: xxxxx.yyyyy.zzzzz.

1. Header The header usually has two parts: the type of the token, which is JWT, and the signing algorithm, like HMAC SHA256 or RSA.

{ "alg": "HS256", "typ": "JWT" }

This JSON is then Base64Url encoded to form the first part of the JWT.

2. Payload The payload contains the claims. Claims are statements about an entity (usually, the user) and additional data. There are three types of claims: registered, public, and private claims.

• Registered claims: These are predefined claims like iss (issuer), exp (expiration time), sub (subject), and aud (audience).
• Public claims: These can be defined at will by those using JWTs. To avoid collisions, they should be defined in the IANA JSON Web Token Registry or be defined as a URI that contains a collision-resistant namespace.
• Private claims: These are custom claims created to share information between parties that agree on using them.

An example payload could look like this:

{ "sub": "1234567890", "name": "Gaurav Sachdeva", "admin": true }

The payload is then Base64Url encoded to form the second part of the JWT.

3. Signature To create the signature, you combine the encoded header, the encoded payload, a secret key, and the algorithm specified in the header.

How JWT Works

1. User Authentication: When a user logs in with their credentials, a JWT is created and signed by the server. This token is then sent to the client.
2. Storing JWT: The client stores the token, usually in local storage or cookies.
3. Sending JWT: Whenever the client makes an API request to a protected route, the token is sent along, typically in the HTTP header using the Bearer schema: Authorization: Bearer <token>.
4. Token Verification: The server receives the token and verifies its signature. If the token is valid, the server processes the request. Otherwise, it responds with an error.

Advantages of JWT

1. Compact: JWTs are small and can be sent via URL, POST parameter, or inside an HTTP header, making them great for mobile applications or single-page applications (SPAs).
2. Self-contained: JWTs carry all the information needed for authentication within the token itself, reducing the need to query the database multiple times.
3. Secure: JWTs are signed, ensuring data integrity and authenticity.

Best Practices

1. Use Strong Secret Keys: Make sure your secret keys are complex and stored securely.
2. Set Expiration Times: Always set an expiration time (exp claim) to limit the token’s lifespan.
3. Use HTTPS: Always use HTTPS to protect tokens in transit.
4. Avoid Storing Sensitive Data: JWTs can be decoded easily, so avoid storing sensitive information in the payload.

Conclusion

JSON Web Tokens provide a simple and secure way to handle user authentication in web applications. By following best practices, you can use JWTs to build secure and efficient authentication mechanisms for your applications.

References

• jwt.io