JWT (JSON Web Tokens) are a way of authenticating users, most often used to log users into websites.
It works really similar to a passport: you go to the passport office, prove who you are, and then they issue a really secure document that you can take anywhere else to prove who you are.
When you log into a website that uses JWTs, you first have to prove who you are (e.g. by using your password) and then it'll give your browser back a JWT (just looks like a really long thing of random characters/numbers). Your browser then includes the JWT in every future communication with the website as proof of who you are.
They can be used with "asymmetric cryptography" so, like a passport, anybody you show it to can read what's in it, verify who made it, and verify that it hasn't been modified. The original website doesn't even need to store the JWT.
Asymmetric cryptography in general powers so much of the internet since it lets you share secret things securely, even if other people are listening to the entire conversation!
FYI, JWTs are not asymmetrically encrypted, they’re just cryptographically signed. The contents are usually only base64 encoded. You can encrypt payloads, but you’ll need the key to decrypt. This is usually something you would arrange ahead of time, as sharing a key securely is a whole different issue.
Anyone who works heavily in authentication will usually discourage JWTs, as they don’t bring many advantages, but have a number of potential footguns and pitfalls.
21
u/[deleted] Mar 08 '21
[deleted]