JSON Web Tokens can carry signed claims that a server verifies. A common API flow is login → issue token → client sends token on protected requests.
Security considerations
- Use HTTPS.
- Keep signing secrets private.
- Use appropriate expiration times.
- Do not place sensitive secrets in the payload.
- Plan rotation and revocation according to your application.
Deep dive
What a JWT contains
A JWT commonly contains a header, payload, and signature. The payload is not a secure place for passwords or secrets because token contents can generally be decoded by anyone holding the token.
Authorization still matters
A valid token proves the token is authentic according to your verification rules. It does not automatically mean the user is authorized to perform every operation.
ADVERTISEMENT