{"id":2969,"date":"2021-01-24T17:54:58","date_gmt":"2021-01-25T01:54:58","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=2969"},"modified":"2021-01-24T17:55:00","modified_gmt":"2021-01-25T01:55:00","slug":"json-web-token-structure-three-parts-separated-by-dots","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=2969","title":{"rendered":"JSON Web Token Structure &#8211; Three Parts Separated by Dots"},"content":{"rendered":"\n<p>All Auth0-issued JWTs have\u00a0JSON Web Signatures (JWSs), meaning they are signed rather than encrypted. A JWS represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures.<\/p>\n\n\n\n<p>A well-formed JWT consists of three concatenated Base64url-encoded strings, separated by dots (<code>.<\/code>):<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>JOSE Header<\/strong>: contains metadata about the type of token and the cryptographic algorithms used to secure its contents.<\/li><li><strong>JWS payload<\/strong>\u00a0(set of\u00a0claims): contains verifiable security statements, such as the identity of the user and the permissions they are allowed.<\/li><li><strong>JWS signature<\/strong>: used to validate that the token is trustworthy and has not been tampered with. When you use a JWT, you\u00a0<strong>must<\/strong>\u00a0check its signature\u00a0before storing and using it.<\/li><\/ul>\n\n\n\n<p>A JWT typically looks like this:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/images.ctfassets.net\/cdy7uua7fh8z\/7FI79jeM55zrNGd6QFdxnc\/80a18597f06faf96da649f86560cbeab\/encoded-jwt3.png\" alt=\"JSON Web Token\"\/><\/figure>\n\n\n\n<p>To see for yourself what is inside a JWT, use the\u00a0JWT.io Debugger. It allows you to quickly check that a JWT is well formed and to manually inspect the values of the various claims.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/images.ctfassets.net\/cdy7uua7fh8z\/5U3Azt2AReuNzNuQqkRs5\/9629ab9924a0212b74bee0b8fa88c295\/legacy-app-auth-5.png\" alt=\"JWT Debugger\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">JOSE header<\/h3>\n\n\n\n<p>JSON object containing the parameters describing the cryptographic operations and parameters employed. The JOSE (JSON Object Signing and Encryption) Header is comprised of a set of Header Parameters that typically consist of a name\/value pair: the hashing algorithm being used (e.g., HMAC SHA256 or RSA) and the type of the JWT.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>    {\n      \"alg\": \"HS256\",\n      \"typ\": \"JWT\"\n    }\n\n<\/code><\/pre>\n\n\n\n<p>Was this helpful?Yes\/No<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">JWS payload<\/h3>\n\n\n\n<p>The payload contains statements about the entity (typically, the user) and additional entity attributes, which are called claims. In this example, our entity is a user.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>    {\n      \"sub\": \"1234567890\",\n      \"name\": \"John Doe\",\n      \"admin\": true\n    }\n    \n<\/code><\/pre>\n\n\n\n<p>Was this helpful?Yes\/No<\/p>\n\n\n\n<p>When working with JWT claims, you should be aware of the different claim types and naming rules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">JWS signature<\/h3>\n\n\n\n<p>The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn&#8217;t changed along the way.<\/p>\n\n\n\n<p>To create the signature, the Base64-encoded header and payload are taken, along with a secret, and signed with the algorithm specified in the header.<\/p>\n\n\n\n<p>For example, if you are creating a signature for a token using the HMAC SHA256 algorithm, you would do the following:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>    HMACSHA256(\n      base64UrlEncode(header) + \".\" +\n      base64UrlEncode(payload),\n      secret)\n    <\/code><\/pre>\n\n\n\n<p>Ref: https:\/\/auth0.com\/docs\/tokens\/json-web-tokens\/json-web-token-structure<\/p>\n","protected":false},"excerpt":{"rendered":"<p>All Auth0-issued JWTs have\u00a0JSON Web Signatures (JWSs), meaning they are signed rather than encrypted. A JWS represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. A well-formed JWT consists of three concatenated Base64url-encoded strings, separated by dots (.): JOSE Header: contains metadata about the type of token and the <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=2969\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[400,4,7],"tags":[566,567],"class_list":["post-2969","post","type-post","status-publish","format-standard","hentry","category-ccnp","category-cert","category-network","tag-json","tag-json-web-token-structure"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/2969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2969"}],"version-history":[{"count":1,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/2969\/revisions"}],"predecessor-version":[{"id":2970,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/2969\/revisions\/2970"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}