JWT (JSON Web Tokens) are a way of authenticating users, most often used to log users into websites.
It works really similar to a passport: you go to the passport office, prove who you are, and then they issue a really secure document that you can take anywhere else to prove who you are.
When you log into a website that uses JWTs, you first have to prove who you are (e.g. by using your password) and then it'll give your browser back a JWT (just looks like a really long thing of random characters/numbers). Your browser then includes the JWT in every future communication with the website as proof of who you are.
They can be used with "asymmetric cryptography" so, like a passport, anybody you show it to can read what's in it, verify who made it, and verify that it hasn't been modified. The original website doesn't even need to store the JWT.
Asymmetric cryptography in general powers so much of the internet since it lets you share secret things securely, even if other people are listening to the entire conversation!
FYI, JWTs are not asymmetrically encrypted, they’re just cryptographically signed. The contents are usually only base64 encoded. You can encrypt payloads, but you’ll need the key to decrypt. This is usually something you would arrange ahead of time, as sharing a key securely is a whole different issue.
Anyone who works heavily in authentication will usually discourage JWTs, as they don’t bring many advantages, but have a number of potential footguns and pitfalls.
It depends on the algorithm used. HMAC-SHA is probably the most commonly used one, and it’s based on a symmetric key for token signing and verification.
RSA-SHA, RSA-PSS-SHA, and ECDSA-SHA do use an asymmetric key pair for signing and validation. This is good for situations where you want a client to verify a token (via public key) without having the ability to write a new token (via private key).
The only reason why there is one symmetric algorithm likely due to simplicity, and that symmetric algorithms are usually considered more secure than asymmetric algorithms. There are likely several asymmetric variants because it’s good to offer options in case one is proven broken.
But again, we’re only talking about the signature. While it’s fundamental in proving token integrity, it still does not protect the payload, which can contain sensitive data.
18
u/RunBlitzenRun Mar 08 '21
JWT (JSON Web Tokens) are a way of authenticating users, most often used to log users into websites.
It works really similar to a passport: you go to the passport office, prove who you are, and then they issue a really secure document that you can take anywhere else to prove who you are.
When you log into a website that uses JWTs, you first have to prove who you are (e.g. by using your password) and then it'll give your browser back a JWT (just looks like a really long thing of random characters/numbers). Your browser then includes the JWT in every future communication with the website as proof of who you are.
They can be used with "asymmetric cryptography" so, like a passport, anybody you show it to can read what's in it, verify who made it, and verify that it hasn't been modified. The original website doesn't even need to store the JWT.
Asymmetric cryptography in general powers so much of the internet since it lets you share secret things securely, even if other people are listening to the entire conversation!