Deep dive into JSON Web Tokens (RFC 7519). Learn header decoding, registered claims, symmetric HMAC vs asymmetric RSA signatures, and security best practices.
1. Anatomy of a JSON Web Token
A JSON Web Token (RFC 7519) is a compact, URL-safe mechanism for transmitting claims between client and server. A JWT consists of three Base64URL-encoded strings separated by periods: Header, Payload, and Signature. Use the JWT Security Hub to inspect claims, analyze expiration, and test signatures locally inside your browser memory.
The JWT payload contains claims that convey user identity and security metadata:
• sub (Subject): Unique identifier for the authenticated user.
• exp (Expiration Time): Unix timestamp beyond which the token is invalid.
• iat (Issued At): Timestamp when token was created.
• iss (Issuer) and aud (Audience): Verification domains ensuring the token is consumed only by the intended recipient.
When implementing or auditing JWTs, protect your application against key vulnerabilities:
1. The "None" Algorithm Exploit: Malicious actors modify the header to `"alg": "none"` to bypass signature verification if the backend library is improperly configured.
2. Weak HMAC Secrets: Symmetric HS256 secrets under 256 bits can be brute-forced offline using GPU hash crackers.
3. Storing Sensitive Secrets in Payloads: Base64URL encoding is NOT encryption. Anyone holding the token can decode and read the payload claims immediately.
4. Debugging Tokens Safely in the Browser
Always decode and inspect token claims locally. Avoid sending auth tokens containing production session IDs or email addresses over external third-party servers.
Key Takeaways
A JWT consists of Header (algorithm), Payload (claims), and Signature (tamper prevention).
Base64URL encoding is not encryption; never store confidential passwords or API keys inside token payloads.
Always enforce signature verification on your API servers and reject tokens with mismatched algorithms.
Use zero-latency client-side decoders to inspect token claims and expiration dates securely.