Understanding JWT: The Key to Secure and Stateless Authentication

In the digital age, securing user data and ensuring safe communication between systems are of utmost importance. While cookies have been the traditional method for maintaining state and managing sessions, JSON Web Tokens (JWT) have emerged as a powerful alternative, offering a more secure, stateless, and flexible approach to authentication. Having explored cookies in the previous blogs, Cookies: Everything You Need to Know About and Using Cookies? — Essential Security and Privacy Tips You Can’t Miss, Let’s understand more about other mechanisms of authentication — JWT.

What is JWT?

JWT stands for JSON Web Token, it is an open standard for securely transmitting information between parties as a JSON object. It ensures the information can be trusted because it’s digitally signed. Imagine it like a secure envelope containing information, which both the sender and receiver can verify that it hasn’t been tempered.

Example: Below is the JWT Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.9vtMYKx_SbvEtJNCohJsFadrstwj7QBcM7j0Jq0DGno

Which encodes the below data — In JWT Terms also known as claims:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Let’s break the token and understand more about how is JWT generated and it’s structure.

Structure of JWT

A JWT is compact and consists of three parts:

1. Header
2. Payload
3. Signature

In the example we saw above contains these parts and is separated by a dot “.” forming a string like header.payload.signature.

Each part is encoded as a base64 string

Header: 
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

Payload: 
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ

Signature:
9vtMYKx_SbvEtJNCohJsFadrstwj7QBcM7j0Jq0DGno

1. Header

The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.

{
  "alg": "HS256",
  "typ": "JWT"
}

This JSON is then Base64Url encoded to form the first part of the JWT.

2. Payload

The payload contains the claims. Claims are statements about an entity (typically, the user) and additional metadata. There are three types of claims: registered, public, and private claims.

• Registered claims: These are a set of predefined claims which are not mandatory but recommended to provide a set of useful, interoperable claims. Some of them include iss (issuer), exp (expiration time), sub (subject), and aud (audience).
• Public claims: These can be defined at will by those using JWTs.
• Private claims: These are the custom claims created to share information between parties that agree on using them.

In our example this part is:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

This JSON is also Base64Url encoded to form the second part of the JWT.

3. Signature

To create the signature part, you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.

For example, if you want to use the HMAC SHA256 algorithm, the signature will be created in the following way:

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn’t changed along the way.

As we are using our secret so any change is data won’t lead to the same signature until and unless the secret is compromised.

So how it all works together?

• User Logs In: The user sends a login request with their credentials.
• Server Verifies: The server verifies the credentials and, if valid, creates a JWT and sends it back to the user.
• User Stores Token: The user stores the JWT (usually in local storage or a cookie).
• Subsequent Requests: For subsequent requests, the user sends the JWT in the Authorization header.
• Server Validates: The server validates the token and, if valid, processes the request.

Benefits of JWT

1. Statelessness: JWTs are stateless. The server doesn’t need to store session information, making it easier to scale.
2. Security: JWTs can be signed and encrypted to ensure data integrity and confidentiality.
3. Interoperability: JWTs are language-agnostic, meaning they can be used across different platforms and technologies.
4. Compactness: JWTs are compact and can be sent via URL, POST parameters, or inside HTTP headers, making them ideal for single sign-on (SSO).

Best Practices

1. Keep it Secret, Keep it Safe: Never expose your secret keys. Store them in environment variables or a secrets management service.
2. Set an Expiration: Always set an expiration time (exp claim) to limit the lifespan of a JWT.
3. Use HTTPS: Always use HTTPS to ensure that JWTs are transmitted securely.
4. Validate Tokens: Always validate the JWT signature and claims before processing it.
5. Consider Refresh Tokens: Use refresh tokens to handle session expiration and renewal securely.

Conclusion

JWTs offer a robust and scalable solution for stateless authentication. By understanding their structure, usage, and best practices, you can leverage JWTs to build secure and efficient authentication systems. As we’ve seen, JWTs bring numerous benefits over traditional session-based authentication, making them a valuable tool in modern web development.