JWTs Explained
summary
Explains JWT internals: header.payload.signature with HMAC SHA-256 or RSA signing, Base64URL encoding, and use of claims (use opaque UUIDs not PII). Shows the Fusion online JWT decoder and demonstrates payload size and performance tradeoffs. Recommends short-lived access tokens (minutes/hours) with long-lived refresh tokens (months/years) and validates every token, including JTI replay prevention. Describes solving Kubernetes sticky-session scaling by switching to stateless JWTs and storing tokens in HTTP-only cookies rather than localStorage.
AI-written summary · about
chapters (7)
- 0:00Introduction to JWTs
- 1:07What are JWTs and why use them
- 6:04JWT structure and components
- 9:21Understanding JWT claims
- 11:12Demo: Decoding a JWT
- 15:26How JWTs are created and used
- 17:12Best practices for JWTs
