JWT is an open standard used for securely transmitting data between parties as JSON objects. It allows for stateless authentication by encoding user login data into a JWT token sent to the client from the server. A JWT contains a header describing the signing algorithm, a payload with user data, and a signature to verify authenticity. The signature is created by hashing the header and payload with a secret key. This workshop example project demonstrates how to create and verify JWTs to authenticate users in a stateless manner on the client side.

1. INTRODUCTION TO
JSON WEB TOKEN (JWT)

2. JSON WEB TOKEN (JWT)
• JWT IS AN OPEN STANDARD FOR SECURELY TRANSFERRING DATA WITHIN PARTIES USING A JSON
OBJECT.
• JWT IS USED FOR STATELESS AUTHENTICATION MECHANISMS FOR USERS AND PROVIDERS, THIS
MEANS MAINTAINING SESSION IS ON THE CLIENT-SIDE INSTEAD OF STORING SESSIONS ON THE
SERVER.

3. JSON WEB TOKEN (JWT)
• SESSION-BASED AUTHENTICATION & TOKEN-BASED AUTHENTICATION
• HOW JWT WORKS
• HOW TO CREATE A JWT
• HEADER
• PAYLOAD
• SIGNATURE
• WORKSHOP

4. SESSION-BASED AUTHENTICATION

5. TOKEN-BASED AUTHENTICATION
• THE USER LOGIN STATE IS ENCODED INTO A JSON WEB TOKEN (JWT) BY
THE SERVER AND SEND TO THE CLIENT.
• NOWADAYS MANY RESTFUL APIS USE IT

6. HOW JWT WORKS

7. HOW TO CREATE A JWT
FIRST, YOU SHOULD KNOW THREE IMPORTANT PARTS OF A JWT:
• HEADER
• PAYLOAD
• SIGNATURE

8. HEADER
THE HEADER ANSWERS THE QUESTION: HOW WILL WE CALCULATE JWT?
NOW LOOK AT AN EXAMPLE OF HEADER, IT’S A JSON OBJECT LIKE THIS:
• TYP IS ‘TYPE’, INDICATES THAT TOKEN TYPE HERE IS JWT.
• ALG STANDS FOR ‘ALGORITHM’ WHICH IS A HASH ALGORITHM FOR GENERATING
TOKEN SIGNATURE. IN THE CODE ABOVE, HS256 IS HMAC-SHA256 – THE
ALGORITHM WHICH USES SECRET KEY.

9. PAYLOAD
• IN THE JSON OBJECT ABOVE, WE STORE 3 USER FIELDS: USERID, USERNAME, EMAIL. YOU CAN SAVE ANY
FIELD YOU WANT.
• WE ALSO HAVE SOME STANDARTDFIELDS. THEY ARE OPTIONAL.
• ISS (ISSUER): WHO ISSUES THE JWT
• IAT (ISSUED AT): TIME THE JWT WAS ISSUED AT
• EXP (EXPIRATION TIME): JWT EXPIRATION TIME

10. SIGNATURE
• THIS PART IS WHERE WE USE THE HASH ALGORITHM THAT I TOLD YOU ABOVE.
LOOK AT THE CODE FOR GETTING THE SIGNATURE BELOW:
• NEXT, WE MAKE A HASH OF THE DATA USING HASH ALGORITHM (DEFINED AT HEADER)
WITH A SECRET STRING.
– FINALLY, WE ENCODE THE HASHING RESULT TO GET SIGNATURE.

11. WORKSHOP
• HTTPS://GITHUB.COM/OLANETSOFT/JWT-PROJECT