DEV Community

JWT (JSON Web Token)

Shubham Yadav on August 16, 2022

What JWT is used for? A JWT is used for authorisation, authorisation is making sure that the user that sends a request to your server is...

Read full post

Almog Tzabari • Aug 17 '22

For a second there I thought JWT = James web telescope 😅

Shubham Yadav • Aug 19 '22

😂😂

The Ngoc Nguyen • Aug 21 '22

🤣🤣🤣

Devarshi Shimpi • Aug 17 '22

Hahaha same.

fmcdev • Aug 18 '22

JWT is great. Essential for single page web apps for example where you don't want to keep user credentials in memory along the session and you rely on continuous calls to REST APIs

Zoppatorsk • Aug 19 '22

One interesting thing that u did not mention. The use of private/public keys..
In short before it gets confusing, u can have one entity that is responsible for signing the JTW (so like a "central login" where u get the JWT from). The signing is done with the private key. The public key, (it's not public in the way everyone can have it) can be used to verify if the JWT is valid (so that key can be used in all services to verify the user).

One important thing to remember about JWT's is that u can not invalidate a JWT (but u can set an expatiation time) as it is "stateless".

Kolja • Aug 17 '22

Thanks a lot😃
But i have a question about the payload:
Is the payload part of the JWT?
And is the payload hashed with the token?
So, will the server recognize, if the payload has been changed on the client?

Zoppatorsk • Aug 17 '22

Payload is part of the JWT and anyone can decode it jwt.io, however the client can't change the payload as the server is the only one having the key it was signed with and with that key can verify that the JWT is valid.