JSON Web Token (JWT)

Definition

A JWT is a compact, self-contained way to encode and securely transmit JSON claims, verified by a secret or key. It’s widely used for sessions, OAuth, stateless auth, password reset, and managing trust. Signature gives integrity; encryption gives confidentiality.

---

Core Ideas

Structure

Three base64url parts separated by dots: header . payload . signature (tokens start with eyJ).

• Header — the signing algorithm
• Payload — claims like exp (expiration), nbf (not before), iss (issuer), sub (subject)
• Signature — e.g. HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

Verifying

Split on dots → base64-decode each part → parse header/payload JSON → read the algorithm → verify the signature → verify the claims.

Attacks (bypassing the signature)

• Not checking the signature at all
• none algorithm — change the header algorithm to none, tamper the payload, drop the signature
• Trivial secret — brute-force a weak secret, then re-sign a tampered payload
• kid injection — abuse the key-id header (path traversal / SQL injection)
• jku/x5u header abuse — point the token at an attacker-controlled key URL

Recommendations

JWT is fragile by design — use strong keys/secrets (never in source code), build in key rotation, vet libraries (KISS), always verify the signature, always set expiry, and enforce the expected algorithm.

---

Relationships

• Cloud Security — tokens and credentials are prime cloud attack targets
• OWASP Top 10 — broken authentication and injection risks
• RESTful API — JWT is a common stateless API auth mechanism
• Serverless — FaaS auth often relies on JWT + OAuth 2.0