In this talk originally presented at the San Diego Javascript meetup on December 3rd 2014, I explain how JSON Web Tokens can be used as a replacement for session/cookie-based user authentication in modern web applications. Since web applications are increasingly leveraging client-side MVC frameworks such as Ember.JS, Angular and Backbone, traditional authentication schemes that leverage cookies are less desirable. I explain the key challenges with traditional authentication schemes and how JWT can be used as a very clean alternative.

1. What are JSON Web Tokens and
why should I care?
December 3rd, 2014
Derek Edwards, CTO CoachLogix

2. Background: Session-based authentication
User Browser Server
Submits credentials
POSTs credentials
Sends response +
Directed to
authenticated view Cookie
stored
Cookie
Cred
Cred
Takes authenticated
action
Sends request +
Cookie
User
verified,
Session
created
Cookie
retrieved
Cookie
matched
with session
ID; action
allowed

3. Sessions: challenges
• NOT RESTful
• Session user state object held in memory
(yuck)
• Hacky implementations in client-side MVC and
native client apps
• Scaling is a nightmare

4. JSON Web Tokens (or JWT)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjEyMzQ1Njc4O
TAsIm5hbWUiOiJKb2huIERvZSIsImFkbWluIjp0cnVlfQ.eoaDVGTClRdf
xUZXiPs3f8FmJDkDE_VCQFXqKxpLsts
• A portable, digitally signed, user authentication
token
• Perfect for client-side MVC web applications and
native mobile applications
• Replacement for session-based authentication?

5. JWT moves the “session” to the client
• At authentication, Server returns JSON object that
contains digitally-signed user ID, role information
• Client stores object (as cookie or in local storage)
and includes within headers of subsequent
requests
• Server validates digital signature in subsequent
requests and is able to immediately respond
appropriately

6. JWT: typical flow
User Browser Server
Submits credentials
POSTs credentials
Sends payload
Directed to
authenticated view JWT
stored
JWT
Cred
Cred
Takes authenticated
action
Sends request +
JWT
User
verified,
JWT created
JWT
retrieved
JWT
signature
verified;
action
allowed

7. JWT: benefits
• APIs now purely RESTful
• Session object eliminated, all relevant data in token
• Easy, non-hacky implementation
• JWT returned in authentication payload and included
as a standard header in subsequent requests
• Scaling is a breeze
• No special load balancing considerations as all calls
purely RESTful

8. JWT: challenge
• Token refresh must be actively managed
• Refresh is part of spec and most server-side
implementations include it
• Client-side must be aware of expiration and
proactively trigger refresh beforehand

9. References
JWT draft spec: http://self-issued.info/docs/draft-ietf-
oauth-json-web-token.html
JWT debugger: http://jwt.io/
jsjws — pure JS implementation of JWT/JWS:
http://kjur.github.io/jsjws/

10. Thanks!
Contact me:
derekbedwards@gmail.com
https://linkedin.com/in/derekbedwards
@derekbedwards