Json Web Token

The composition of JWT tokens

Head (header), in the following format:
{
"Typ": "JWT",
"ALG": "HS256"
}
From the above, the token uses the HS256 encryption algorithm, which uses the BASE64 encoding of the head to obtain a string in the following format:

Payload (playload):
{
"ISS": "Online JWT Builder",
"IAT": 1416797419,
"Exp": 1448333419,
.......
"UserID": 10001
}
The payload contains token issuer (ISS), issue time (IAT), expiry time (exp), and some information that we need to write into token. Payload also uses BASE64 encoding to get a string in the following format:

Signature (Signature):
The header and Playload stitching generates a string str= "Eyjhbgcioijiuzi1nij9.eyj1c2vyawqiojb9", using the HS256 algorithm and the key we provide (secret, The server itself provides a string) to encrypt str to generate the final JWT, which is the token we need, as in the form: Str. " Signature string ".

Token interaction process between the service and the client

1: Client logs in with user name and password
2: The server verifies the user name and password, and, if passed, generates tokens to return to the client.
3: After receiving token, the client takes the token with each request, which is equivalent to a token, indicating that I have access to the
4: The server receives (usually implemented in the interceptor) to the token, and then verifies the legitimacy of the token (why it can be verified below). If the token is legal, the request fails if the token is illegal or expires.

Thinking about Token

How does the service determine if this token is legal?
By the generation of the token above, it is known that the signature in token is generated by the header and payload via BASE64 encoding and then finally generated by the cryptographic algorithm HS256 and the key, which is located at the tail of the JWT. The server side also makes a signature build on the front part of the returned JWT, then compares the resulting signature with the signature in the requested JWT, if the token is valid. Because the signature key is generated by the server, it is difficult for others to forge.

Can you put sensitive information in token?
No, because the payload is generated by BASE64 encoding and is not encrypted. Therefore, you cannot store sensitive information.

The benefits of token

(1) compared to the session, it does not need to be saved on the server, and does not occupy the server memory overhead.
(2) Stateless, extensible strong: For example, there are 3 machines (A, B, C) to form a server cluster, if the session exists on machine A, session can only be saved in one of the servers, at this time you can not access machine B, C, because B, C did not store the session, The use of tokens can verify the legitimacy of the user request, and I add a few more machines are OK, so the extension of good is this meaning.
(3) by (2), this can support cross-domain access.

Json Web Token