How JWT Works: A Deep Dive into JSON Web Tokens

By /

Listen to this Post

Featured Image
JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims between two parties. They are widely used for authentication and authorization in modern web applications and microservices architectures.

Structure of a JWT

A JWT consists of three parts separated by dots (.):
1. Header – Contains metadata about the token (e.g., algorithm used).
2. Payload – Contains claims (user data, expiration time, etc.).
3. Signature – Ensures the token hasn’t been tampered with.

Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

How JWT Authentication Works

  1. User Login – Client sends credentials to the server.
  2. Server Validation – Server verifies credentials and generates a JWT.
  3. Token Return – Server sends the JWT back to the client.
  4. Client Storage – Client stores the JWT (commonly in localStorage, sessionStorage, or cookies).
  5. Subsequent Requests – Client includes the JWT in the `Authorization` header (Bearer <token>).
  6. Server Verification – Server validates the JWT signature and processes the request.

You Should Know: Practical JWT Implementation

1. Generating a JWT (Node.js Example)

const jwt = require('jsonwebtoken'); 
const secretKey = 'your-secret-key';

const payload = { 
userId: '12345', 
username: 'johndoe', 
exp: Math.floor(Date.now() / 1000) + (60  60) // Expires in 1 hour 
};

const token = jwt.sign(payload, secretKey); 
console.log(token);

2. Verifying a JWT

jwt.verify(token, secretKey, (err, decoded) => { 
if (err) { 
console.error('Invalid token'); 
} else { 
console.log('Decoded payload:', decoded); 
} 
});
  1. Linux Command to Inspect JWT (jq required) 
    echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" | cut -d '.' -f 2 | base64 -d | jq

4. Windows PowerShell JWT Decoding

$token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" 
$payload = $token.Split('.')[bash] 
$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($payload)) 
Write-Output $decoded

5. Security Best Practices

  • Use HTTPS – Prevent man-in-the-middle attacks.
  • Short Expiry – Set a reasonable expiration time.
  • Store Securely – Avoid `localStorage` if XSS is a concern; use `HttpOnly` cookies.
  • Strong Secret Key – Use a long, random key.

What Undercode Say

JWTs are powerful but require careful implementation. Misconfigurations can lead to security vulnerabilities like token theft or tampering. Always:
– Validate token signatures.
– Avoid storing sensitive data in the payload.
– Rotate keys periodically.
– Monitor for unusual token usage.

For further reading, check Neo Kim’s detailed guide:

→ https://lnkd.in/ek9_BTUc

Prediction

As microservices and serverless architectures grow, JWTs will remain a dominant authentication method. Future enhancements may include quantum-resistant algorithms and tighter integration with zero-trust security models.

Expected Output:

A structured, actionable guide on JWT implementation with practical code snippets and security best practices.

References:

Reported By: Nk Systemdesign – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: