WT* is JWT?
summary
Explains that JWT is a format, not a single protocol, and distinguishes JSON Web Signature (JWS) vs JSON Web Encryption (JWE), shows RSA key math with tiny primes (11 and 3) and notes real keys are 1024+ bits, demonstrates using JWKS for key rotation so compromised private keys are invalidated, warns JWT is not encrypted — only encoded or signed, recommends not storing secrets in claims, shows offloading signature validation to an API gateway (Akamai) and tools like hashcat for attacking weak HMAC keys.
AI-written summary · about
chapters (23)
- 0:00Start
- 3:42Asymmetric cipher
- 4:14RSA key
- 6:21What if...?
- 6:46Breaking the RSA
- 8:15Signing
- 10:28JSON Web Signature
- 11:16So.. What the **** is JWT?
- 11:41Registered claims
- 12:31Custom claims
- 13:20Pre JWT authorization
- 16:57Delegate validation to 3rd parties
- 17:26Further reading
- 17:54OAuth
- 19:14JWKS
- 22:28Data Security
- 23:00Unsigned JWT
- 23:34Error Responses
- 24:02Weak Key
- 25:02Decoding != Verifying
- 25:46"Time" attack
- 26:20jku validation
- 26:57Resources
