Let's talk about JWT
summary
Explains the actual JWT bits: RFC 7519 and JOSE, three-part string with base64url header payload signature, common algorithms like HS256 secret reuse versus asymmetric keys (public/private, SSH/PEM), real code using PyJWT showing jwt.decode and get_unverified_header, where ID tokens and access tokens appear in OAuth flows, tools like jwt.io debugger and a published handbook, and concrete safety outcomes — don’t store tokens in localStorage, don’t verify secrets in the frontend, and never put sensitive data in the payload.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:05Understanding JWT
- 2:36JWT structure
- 4:06JWT header and payload
- 5:58Claims types and security
- 7:56The signature part
- 8:39Signing algorithms
- 10:08Sharing keys
- 11:13Python implementation
- 12:49Verifying without secret
- 14:23Handling exceptions
- 15:38Asymmetric verification
- 17:20JWT use cases
- 19:21Security best practices
- 21:02Tools and conclusion
