JWT! What is it good for? Absolutely everything!
summary
Explains JWT structure (header.payload.signature) and shows how signatures use HMAC256 signature so receivers can verify integrity without calling the issuer; emphasizes tokens are not encrypted and therefore must not hold secrets. Traces lineage from OAuth 2.0 and OpenID Connect, and demonstrates a concrete build: a React web store using Auth0 + Stripe proof of concept with Netlify functions storing the Stripe customer ID inside the token to avoid a custom DB. Warns token bloat hurts latency and every request carries the token in the header.
AI-written summary · about
