JWT

Definition

JWT, or JSON Web Token, is a compact and self-contained way for securely transmitting information between parties as a JSON object. It is commonly used for authentication and information exchange. A JWT is made up of three parts: a header, a payload, and a signature. The header typically consists of the type of token and the signing algorithm being used. The payload contains the claims, which are statements about an entity (usually the user) and additional data. The signature is created by combining the encoded header, encoded payload, and a secret key.

Why it matters

JWTs are important because they provide a secure method for transmitting information that can be verified and trusted. They are widely used in modern web applications for user authentication, allowing users to log in once and access multiple services without needing to re-enter their credentials. This reduces the risk of password theft and enhances user experience. Additionally, JWTs can be easily passed in URL parameters, HTTP headers, or cookies, making them versatile for various applications.

Example in VCA

In Vibe Code Academy (VCA), JWTs are used to manage user sessions. When a user logs in, the server generates a JWT that contains the user's ID and role. This token is then sent back to the client and stored in local storage. For subsequent requests, the client includes the JWT in the HTTP headers, allowing the server to verify the user's identity and permissions without needing to access the database repeatedly. This streamlines the authentication process and improves performance.

Another Real World Example

A common real-world example of JWT usage can be found in single-page applications (SPAs). When a user logs into an SPA, the application requests a JWT from the server. This token is then stored in the browser's local storage. As the user navigates through the application, the JWT is sent with each request to the server, allowing the server to authenticate the user and provide access to protected resources. This method ensures that the user remains logged in while maintaining security and efficiency.

Common mistakes

• One common mistake is failing to validate the JWT on the server side, which can lead to unauthorised access.
• Another mistake is using weak signing algorithms, which can make the JWT vulnerable to attacks.
• Developers sometimes forget to set an expiration time for the JWT, leading to tokens that remain valid indefinitely.
• Not securely storing the JWT on the client side can expose it to cross-site scripting (XSS) attacks.
• Lastly, some may overlook the importance of using HTTPS, which is essential for protecting the token during transmission.

Related terms

• <a href="/glossary/api" data-glossary="api" class="glossary-term">API</a>