Mastering JSON Web Tokens (JWT): Structure, Claims & Security

JSON Web Tokens (JWT), defined in RFC 7519, are an open, industry-standard method for securely representing claims between two parties. They are widely used for stateless authentication and API authorization.

1. The Anatomy of a JWT

A compact JWT consists of three parts separated by dots (.):

1. Header: Contains the token type (JWT) and signing algorithm (HS256, RS256, ES256).
2. Payload: Contains the claims (statements about an entity, such as user ID, roles, and expiration).
3. Signature: Generated by taking the encoded header, encoded payload, a secret or private key, and passing them through the specified algorithm.

2. Critical Security Pitfalls

• Never Store Secrets in the Payload: JWT payloads are Base64URL-encoded, NOT encrypted. Anyone who intercepts the token can decode the payload instantly.
• The "alg": "none" Vulnerability: Older libraries improperly accepted unsigned tokens if the attacker set the algorithm header to none. Ensure your backend enforces strict algorithm verification.
• Symmetric (HS256) vs Asymmetric (RS256): For microservices where multiple consumers verify tokens, use asymmetric keys (RS256/ES256) so only the auth server possesses the private signing key.