Inside a JWT
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
read a JWT and name its three parts.
Planned topics
- A JWT (JSON Web Token) is three Base64URL parts joined by dots: header.payload.signature.
- Header: algorithm and type (
alg,typ). Payload: claims such assub(subject),iss(issuer),aud(audience),exp(expiry),iat. - The signature proves the header and payload were not changed, by a key.
- The payload is encoded, not encrypted: anyone can read it. Never put secrets or personal data in claims.
- Keep tokens small.
Draft outline details
Demonstration
a decoded token:
{"alg":"HS256","typ":"JWT"}
{"sub":"42","iss":"shop","aud":"shop-api","exp":1893456000,"roles":["CUSTOMER"]}Check your understanding
Is a JWT payload secret?
Show answer
No. It is only encoded, so anyone can read it.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.