JWT, WTF?
summary
JSON Web Tokens are shown as three URL safe base64 parts (header payload signature) and actually built by encoding JSON then signing with HS256 signing with Node crypto; verification recomputes the HMAC and compares signatures, JWT.io is used to debug tokens and signatures so you can confirm validity. Pitfalls include the alg none attack, public readable claims, storage tradeoffs (cookies vs localStorage), and revocation via jti plus a blacklist. A Twilio emoji chat proof of concept issues tokens and demonstrates signature validation.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:45Twilio
- 1:31Abbreviations
- 6:52Stateless Sessions
- 8:34Open Id Connectors
- 8:51Client-Side Authentication for Third Party Services
- 10:50Creating a Jot
- 11:40An Encoded Header
- 12:16Payload
- 12:44Claims
- 13:47Standard Claims
- 15:19Cryptography
- 20:58Pitfalls
- 24:09Micra Service Architecture
