Understanding JSON Web Tokens (JWT)

Anatomia do JWT

JSON Web Tokens (JWTs) are a widely used standard for securely transmitting information between parties as a JSON object, enabling stateless authentication; a server doesn’t need to store user session data, as all necessary information resides within the token itself. This is particularly valuable in distributed applications like mobile apps and SPAs.

JWTs consist of three parts – the header, the payload, and the signature – separated by periods. The signature ensures the token’s integrity and authenticity.

Why This Matters

Traditional session management relies on server-side storage, creating scalability bottlenecks and potential single points of failure. JWT’s stateless nature avoids these issues, but introduces the risk of exposing information in the payload if not handled carefully. A compromised secret key can lead to complete token forgery, potentially granting unauthorized access to sensitive resources.

Key Insights

• JWT is an open standard (RFC 7519, 2013) defining a compact, URL-safe means of representing claims to be transferred between two parties.
• Stateless authentication reduces server load and complexity compared to traditional session-based approaches.
• The security of a JWT hinges on the secrecy of the signing key; compromised keys render the entire system vulnerable.

Working Example

// Example JWT structure (for demonstration purposes only - do NOT hardcode secrets)
const header = {
  alg: "HS256",
  typ: "JWT"
};

const payload = {
  sub: "1234567890",
  name: "John Doe",
  admin: true
};

const secret = "your-secret-key"; // Replace with a strong, randomly generated secret

// In a real application, you would use a library to encode and sign the JWT
function signJWT(header, payload, secret) {
  const headerEncoded = Buffer.from(JSON.stringify(header)).toString('base64url');
  const payloadEncoded = Buffer.from(JSON.stringify(payload)).toString('base64url');

  const data = `${headerEncoded}.${payloadEncoded}`;
  const hmac = require('crypto').createHmac('sha256', secret);
  hmac.update(data);
  const signature = hmac.digest('base64url');

  return `${data}.${signature}`;
}

const jwt = signJWT(header, payload, secret);
console.log(jwt);

Practical Applications

• Authentication for Microservices: Netflix uses JWTs to authenticate requests across its various microservices, enabling secure and scalable communication.
• Pitfall: Storing sensitive data (like passwords) directly in the JWT payload is a major security risk, as the payload is easily decoded. Always store sensitive data securely on the server-side.

References:

• https://dev.to/ewertoncodes/entendendo-o-json-web-token-jwt-1b38
• https://datatracker.ietf.org/doc/html/rfc7519