Securing Spring Boot Application | Json Web Token (JWT) | Introduction | Simple Programming
Welcome to Simple Programming
A JSON Web Token (JWT) is a JSON object that is defined in RFC 7519 as a safe way to represent a set of information between two parties. The token is composed of a header, a payload, and a signature.
Most of the implementations use JWT nowadays
Usually contains information about the issuer, subject, signed value (make it authentic), expiration time, etc
Client/consumer requests for token, issuer issues the token, and then the client can consume the resource using that token
Encryption: It is the process of locking up information using cryptography. Information that has been locked this way is encrypted.
Decryption: The process of unlocking the encrypted information using cryptographic techniques.
Key: A secret like a password used to encrypt and decrypt information. There are a few different types of keys used in cryptography
Symmetric key - using same key for encryption and decryption of the cipertext
Asymmetric key - using a public and private/secret key
Token History
SAML 1.1/2.0
- most used and popular, XML based, many encryption and signature options. - but u need advance xml parsing engines to work with this
Simple Web Token (SWT) - very simple like a key value pair
- only symmetric signatures, too simple
Json Web Token (JWT)
Json encoded
Symmetric and asymmetric signatures (HMACSHA)
Symmetric and asymmetric encryption (RSA, AES, etc)
Structure
Header
Metadata
Algorithim or keys used
Claims
Issuer claim - like who has issued
Audience Claim - like who can be an audience
IssuedAt
Expiration
Subject - identifier for the claim
{
Typ: JWT
Alg: HS256
}
{
Iss:
Exp:
Aud:
Sub:
Client:
Scope: [READ, WRITE]
}
QWQWQWQWQ&W.9q9wqw87878qwASASAS7878qw.qwqwqwqw7878QWQWQWQWqw
Header. Claims(payload). signature