JWT Authentication Course

13 lessons · free to read

What is actually inside a token - decode it, edit a claim, watch verification fail.

Lessons

Three parts, two dotsA JWT is not encrypted. Anyone can read it - the signature only proves it was not altered.
Standard claims and what they are forSeven registered claims carry the security meaning. The rest is yours.
HS256 vs RS256Shared secret or public key - the choice decides who is able to mint tokens.
The alg:none attackThe classic JWT vulnerability, and why it is a library-configuration problem.
The revocation problemStateless validation is the selling point and the weakness in the same sentence.
Where to store a token in a browserlocalStorage or a cookie - each trades one attack for another.
When NOT to use a JWTJWTs became the default answer to a question many apps were not asking.
Tokens or sessions: which problem are you solvingStateless is a trade, not an upgrade.
Validating a token, step by stepSeven checks, and what skipping each one lets an attacker do.
Refresh tokens and rotationShort access tokens are only safe if refresh is designed properly.
JWKS and rotating signing keysHow verifiers find the key, and how to change it without an outage.
Wiring a resource server in Spring BootFrom dependency to a working authority check.
Signed, encrypted, or bothA JWS proves who wrote it; anyone can read it.