JWT (JSON WEB TOKENS)

What is JWT?

JWT, or JSON Web Token, is a compact and self-contained way of securely transmitting information between parties as a JSON object. It's commonly used for authentication and authorization in web applications. Hashing is used to sign them and confirm that the contents have not been changed.

For example, when you log in to a website , the platform creates a JWT token with specific information and hashes it to safeguard your data. Even though your data is not open and exposed, the website you wish to sign in to can identify the end user by using the issued information. Your private data is stored in the token, which protects it. JWTs are a fantastic way to protect your user data and confirm that you are whom you say you are.

Structure:

A JWT consists of three parts separated by dots:

1) The header,

2) The payload,

3) The signature.

These parts are base64url encoded.

• Header: Contains metadata about the type of token and the signing algorithm used.
• Payload: Contains the claims. Claims are statements about an entity (typically the user) and additional data.
• Signature: To create the signature part, you take the encoded header, the encoded payload, a secret, and the algorithm specified in the header and sign that.

Workflow

REST API Authentication + JSON Web Tokens(JWT)

A user make a login request. As soon as a request is made, user details are checked in database. If the login details are valid then Access JWT and Refresh JWT are created and stored. If not, they are sent back to login page. We can create them by using sign method as well as we can define it's expiry.

REST API Authorization with JWT management:

First client makes a API call with JWT headers. And the JWT is received via Authorization header.

Then the JWT is decoded to verify if it is valid or not?

After that the token is checked in database whether it exist or not.

Then we need to get user, for example if we are getting by email. So we need to extract email from decoded JWT object. Get user by email and if user exist authorize them

.