Download as PDF, PPTX
Uploaded byDeddy Setyadi
JSON Web Token
The document explains JSON Web Tokens (JWT), which are digitally signed tokens that allow for stateless authentication without server-side storage. It details the structure of a JWT, which includes a header, payload (claims), and signature, as well as typical algorithms used for signing. It also addresses security concerns like CSRF and man-in-the-middle attacks, providing references for further reading.
More Related Content
![[OPD 2019] Attacking JWT tokens](https://cdn.slidesharecdn.com/ss_thumbnails/attackingjwttokens-191021171156-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
![PHP Experience 2016 - [Palestra] Json Web Token (JWT)](https://cdn.slidesharecdn.com/ss_thumbnails/17h00ivanrosolen-160331183444-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
JSON Web Token
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9. Header { "typ": "JWT", "alg": "HS256" } PARTSOFTheheader: ●declaringthetype,which isJWT ● thehashingalgorithmto use
- 10. CommonJWTSigningAlgorithms HS256 HMAC usingSHA-256 RS256 RSASSA-PKCS1-v1_5 using SHA-256 ES256 ECDSA using P-256 and SHA-256 https://tools.ietf.org/html/rfc7518#section-3
- 11. Payload Carrytheinformationthatwe wanttotransmit,alsocalled theJWTClaims. { "iss": "scotch.io", "exp": 1300819380, "name":"Chris Sevilleja", "admin": true }
- 12.
- 13. Signature Madeupofahashofthe followingcomponents: ● theheader ● thepayload ●secret var encodedString = base64UrlEncode(header) + "." + base64UrlEncode(payload); HMACSHA256(encodedString,'secret');
- 14.
- 15. References ● http://www.slideshare.net/liuggio/json-web-token-api-a uthorization ● https://scotch.io/tutorials/the-anatomy-of-a-json-web-t oken ●https://auth0.com/blog/json-web-token-signing-algorit hms-overview/ ● http://jwt.io ● https://blog.digicert.com/thwarting-man-middle/ ● https://www.incapsula.com/web-application-security/cs rf-cross-site-request-forgery.html