Demystifying JWTs
summary
Explains what a JWT actually contains (header, payload, signature), how signatures are created and verified by hashing header+payload and comparing with an encrypted signature, and how public keys are fetched from a well-known endpoint or referenced in the header. Covers WebSocket authentication tradeoffs: query parameter is exposed, token as first message works but large tokens can break some servers so custom payload per message is an alternative. Notes the spec even allows alg=none (unsigned tokens) and that libraries handle most cases but manual validation is sometimes required.
AI-written summary · about
chapters (7)
- 0:00Introduction to JWTs
- 1:03Session vs token authentication
- 2:31JWTs in WebSocket protocols
- 4:44JWT anatomy explained
- 6:51How JWT signatures work
- 8:17Validating JWTs manually
- 10:43Summary and Q&A
