Auth
JWT
A compact signed token in JSON format that carries claims about a user or permissions.
What it is
A JWT has three dot-separated parts: header, payload and signature, each Base64URL. The signature guarantees the data was not altered, but the payload is not encrypted, so keep no secrets in it.
A server can verify the token without hitting the database: a key is enough. That suits distributed systems and microservices. The downside: revoking an issued token before expiry is hard.
JWT is most often used as an access token in OAuth 2.0 and an ID token in OIDC. Pin the signing algorithm explicitly (for example RS256 or ES256) and reject alg: none.
Use it when
- Stateless authorization between services and APIs.
- ID token and access token in OAuth 2.0 / OIDC.
- Short-lived signed messages (email confirmation links).
Avoid it when
- Classic web sessions of a single app: a server session with a cookie is simpler and easy to revoke.
- Storing sensitive data in the payload.
Key concepts
- Header / Payload / Signature
- Algorithm, claims and signature.
- Registered claims
iss,sub,aud,exp,iat.- HS256 vs RS256
- A shared secret versus a private and public key pair.
- JWKS
- A set of public keys for verifying signatures.
Example
Cheat sheet
| Command or code | What it does |
|---|---|
header.payload.signature | Token structure: three parts separated by dots |
{ "alg": "HS256", "typ": "JWT" } | Header: signing algorithm and type |
{ "sub": "42", "exp": 1893456000 } | Payload: claims about the user and expiry |
Authorization: Bearer <token> | Send the token in a request header |
sub | Who the token belongs to (user id) |
exp / iat / nbf | Expiry, issued at and not before (Unix seconds) |
iss / aud | Who issued the token and who it is for |
await new SignJWT({ sub }).setProtectedHeader({ alg: "ES256" }).setExpirationTime("15m").sign(key) | Issue a token with the jose library |
const { payload } = await jwtVerify(token, key, { audience: "api" }) | Verify signature and claims in jose |
Set-Cookie: token=...; HttpOnly; Secure; SameSite=Lax | Store the token in a safe cookie |
How to learn it
- Understand what a JWT is: three parts (header, payload, signature) encoded in base64url but not encrypted.
- Decode any token on jwt.io and look at the claims:
sub,iat,exp,iss,aud. - Issue and verify a token in code with a library (jose, jsonwebtoken), first with HS256, then RS256 or ES256.
- Learn the difference between symmetric and asymmetric signing and when you need JWKS.
- Implement an access and refresh token scheme: short access, refresh rotation, revocation.
- Decide where to store the token in the browser: httpOnly cookie versus localStorage, and the risks (XSS, CSRF).
- Avoid common traps: the
nonealgorithm, algorithm confusion, checkingexp,aud,iss, secrets in the frontend. - Learn when you do not need JWT: plain server sessions are often simpler and safer.
Interview questions
1. Does a JWT encrypt data?
No, a signed JWT only protects integrity. The payload can be read by Base64URL decoding, so sensitive data does not go there. JWE exists for encryption.
2. How do you revoke a JWT?
Keep a short lifetime, rotate refresh tokens and keep a denylist of
jtiids for critical cases. Fully stateless revocation is impossible.3. Why is
alg: nonedangerous?An attacker can forge an unsigned token if the server trusts the header. So the algorithm is fixed on the server, not taken from the token.
Interview questions from the bank
- Walk a request through authentication with Passport and JWT in NestJS, from login to
req.userin the controller. What must never go into the token?MiddleNode.js - All endpoints of a NestJS API must require a JWT by default, except
/healthand/auth/login. How do you do this so a new controller cannot be accidentally left open?MiddleNode.js - There are the roles admin, manager and viewer and several companies in a holding. How do you design RBAC on the backend? Where do you store roles, where do you check them, and when are roles no longer enough?MiddleHTTP
- Compare server sessions and JWT. How does this affect logout, scaling and security? What would you choose for an SPA with its own backend, and where do you store the token?MiddleHTTP
- Can you read a JWT payload without the secret key, and what happens if you edit it by hand? What else must the server check besides the signature?MiddleHTTP
- An access token lives 15 minutes, a refresh token 30 days. The refresh token was stolen. How do you reduce the damage? What are rotation and reuse detection, and how do you implement sign-out from all devices?SeniorHTTP
- How does authentication differ from authorization?JuniorWeb security
- What is a JWT, what does it consist of, and is it encrypted?JuniorWeb security
Related technologies
- OAuth 2.0A delegated authorization standard: an app gets limited access to a user's resources without their password.
- OpenID ConnectAn authentication layer on top of OAuth 2.0: the client receives an ID token with user information.
- Auth.jsAn open source authentication library for web apps (formerly NextAuth.js), with OAuth providers and sessions.
- KeycloakAn open source identity and access management solution with SSO, OIDC, SAML and roles.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).