WT* is JWT?
summary
JWT is an abstract token format implemented as JWS (signed) or JWE (encrypted); typical deployments use JWS so payloads are signed not encrypted. Example math uses toy RSA (p=11, q=3 → n=33, e=3, d=7) to show signing/verification. Practical points: microservices and OAuth can use JWT to avoid round trips and offload validation to gateways or CDNs (Akamai API Gateway), rotate keys with JWKS (jku + kid), never store sensitive data in a JWS, always verify signatures and validate jku to avoid none/alg and weak HS256 attacks.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:23Meet the speaker
- 2:05School-time analogy
- 7:26Asymmetric cryptography
- 9:51JSON Web Signature
- 11:17What JWT is
- 13:04Microservices auth
- 17:48Third-party auth
- 19:13JWKS and key rotation
- 21:45Compromised keys
- 22:27JWT pitfalls
- 25:40JWT validation
- 26:44Summary
