JWT (JSON Web Token)

I. Overview link

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
    A["Session-based\nauthentication (stateful)"] -- "Removing server scalability limits and\nsession-management overhead" --> B["JWT-based\nauthentication (stateless)"]
    style A fill:#f9f9f9,stroke:#333,stroke-width:3px
    style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: An open standard (RFC 7519) for securely representing information in JSON form using a digital signature or encryption, used mainly for SSO (Single Sign-On) and exchanging authentication data in web environments.

Features:
( Stateless Authentication ) The server can authenticate a user and verify their information from the JWT alone, without storing any client state
( Compact Structure ) A lightweight JSON format that is easy to transmit — for example, through HTTP headers — making it well suited to web environments
( Extensibility ) Follows a standardized structure (Header, Payload, Signature) and can carry a wide variety of claims flexibly
( Security ) A digital signature authenticates the issuer and prevents tampering with the token’s contents

II. Mechanism & Components link

A. The Three Parts of a JWT: Header, Payload, Signature link

graph TD
    A["Header\n(algorithm, token type)"] -->|"Base64 encoding"| EncodedHeader["Encoded Header"]
    B["Payload\n(claims: user info, privileges, etc.)"] -->|"Base64 encoding"| EncodedPayload["Encoded Payload"]

    subgraph "Signature Generation"
        direction LR
        Secret["Secret Key"]
        EncodedHeader -- "HMAC SHA256, etc." --> HashedData["Encoded Header + Payload"]
        HashedData -- "Generate signature" --> Signature["Encoded Signature"]
    end

    EncodedHeader & EncodedPayload & Signature -->|"joined by the '.' separator"| JWT["JWT (Header.Payload.Signature)"]

• Header: Contains the token type (JWT) and the algorithm used for signing (alg: HS256, RS256, etc.)
• Payload: The token’s actual content — claims such as the subject identifier (sub), issuer (iss), expiration time (exp), and scope (scope)
• Signature: Generated by encrypting the Header and Payload with a Secret Key or Private Key; verifies the integrity of the Payload using the algorithm named in the Header together with the Secret Key

B. JWT Issuance and Verification Process link

1. Login request: The user requests a login with an ID/password
2. JWT issuance: The server generates the Header and Payload from the user’s information, creates the Signature with the Secret Key, and issues the JWT
3. Client storage: The client stores the issued JWT in local storage (localStorage) or a cookie (Cookie)
4. On API requests: The client sends the stored JWT to the server in the HTTP header (Authorization: Bearer <token>)
5. Server verification: The server verifies the received JWT’s Signature using the Secret Key and checks the Payload’s information (expiration, scope, etc.) before processing the request

III. Advanced Topics & Comparison link

A. JWT Security Vulnerabilities link

• Secret key exposure: If the secret key is exposed when using an HMAC algorithm, every token can be forged
• Algorithm abuse: Exploiting alg:none or bypassing signature verification
• Payload exposure: A JWT is only Base64-encoded, so decoding it reveals its contents (avoid storing sensitive information)
• Unverified expiration: Failing to check the expiration time (exp) allows a stolen token to be reused
• Weak storage: Storing a JWT client-side in localStorage is vulnerable to XSS attacks

B. JWT Security Hardening link

• Strong secret-key management: When using HS256, store the key safely and rotate it periodically; RS256 (public/private key) is recommended
• Algorithm verification: When receiving a JWT, verify that the signing algorithm (alg) is the expected one and is not none
• No sensitive data in the payload: Never store sensitive personal information or passwords in a JWT (encrypt if necessary)
• Verify expiration (exp) and issued-at (iat): Always check whether the token has expired and when it was issued
• Use safe storage: Prefer an HttpOnly cookie to block JavaScript access; if using localStorage, XSS defenses are mandatory

Key Point: JWT is a powerful tool for stateless authentication, but it demands strict adherence to security principles — careful secret key management, signature verification, and safe storage.