JSON Web Token helps to secure your REST API by encrypting PII information while sharing between two parties.

1. JSON Web Tokens
Data Obfuscation and Authorization
EMAIL: TVAJJALA@GMAIL.COM

2. What is JWT
JSON Web Token (JWT) is an open
standard (RFC 7519) that defines a
compact and self-contained way for
securely transmitting information
between parties as a JSON object.

3. JWT
Implementations
JWT specification comes
with two different
implementations
1. JSON Web Signature
2. JSON Web Encryption

4. JavaScript Object Signing and
Encryption (JOSE)
JWT defines the token format and uses complementary specifications to
handle signing and encryption, this collection of specifications is known as
JOSE (JavaScript Object Signing & Encryption) and consists of the
following components
1. JWS - Defines the process to digitally signing JWT
2. JWE - Defines the process to encrypt a JWT
3. JWA - Defines list of algorithms for signing and encryption
4. JWK - Defines how a cryptographic keys to be represented

5. JWT Claims
JWT defines seven pre-defined(optional) claims to represent the token
iss Issuer of the token
sub Subject that the JWT is representing
aud Audience for the JWT
exp Time the JWT is set to expire
nbf Time the JWT is valid from (not-before)
iat Time when JWT issued
jti JWT ID (unique ID)

6. Authorization Tokens
JWT Token contains three parts separated by period (.) and starts with Bearer
Bearer eyJhbGciOiJIUzI1NiIsInR5IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsImlh6MTUxNjIzOTAyMn0.sVt6cyu3HKd89LZVMNbqT0DTl3FvG9oYbj8hBDqU
NOTE: The Bearer scheme is used by many APIs for its simplicity. The name Bearer implies that the application
making the request is the bearer of the following pre-agreed token. In summary: you need to put Bearer up front to
tell the server that what follows is an API token, and not something else.

8. Data Obfuscation
Data masking or data obfuscation is the process of hiding original data
with modified content The main reason for applying masking to a data
field is to protect data that is classified as personally identifiable
information(PII) , sensitive personal data, or commercially sensitive data.

9. Data Obfuscation Using JWT
1. Create a class that contains sensitive information.
2. Add @Obfuscate annotation to the sensitive data attributes
3. Extend that class to WebToken.
4. Pass the object to WebTokenUtil.generateToken(T ) method to generate JWT Token.
Method signature:
public static <T extends WebToken> String generateToken(final T clazz);

10. CustomerInfo customerInfo = new CustomerInfo();
customerInfo.setAccountId(939939939);
customerInfo.setCard("4123773773838838");
customerInfo.setSocial(”999-99-9999”);
transactionKey.setPhone(”999-999-9999”);

11. public class CustomerInfo extends WebToken {
@Obfuscate(strategy = Strategy.CARD)
@JsonProperty(”card")
private String card;
@JsonProperty("ssn")
@Obfuscate(strategy = Strategy.SSN)
private String social;
@JsonProperty("phn")
@Obfuscate(strategy = Strategy.PHONE)
private String phone;
}