How to make sure that the document is written by me and only me. In a physical world, we usually signed under the document with our unique handwriting. Now the second party should identify that it is my signature. Still, chances are there, people will manipulate the content. To avoid the same we used to sign granular pieces of the information i.e. each page. It is not easy to replace content in a single page. Not yet. So this makes sure information is authenticated by me and can be quoted for me.
Now, how do we do the same practice in the virtual world? We use JWT (JSON WEB TOKEN). A JSON web token is simply JSON payload containing a particular claim. It has three parts all separated by ".".
- Header
- Payload
- Signature
Header:
The header typically consists of two parts: the type of token, which is JWT, and the hashing algorithm that is used, such as HMAC SHA256 or RSA. Its base64 encoded string.
{ "alg": "HS256", "typ": "JWT"}Payload:
Its has the claim of the user. Its also base64 encoded string.
{ "expireAt": "1234567890", "name": "John Doe", "role": "admin"}Signature:
Signature of the above information will be created by the below method:
HMACSHA256( base64UrlEncode(header)+ "." +
base64UrlEncode(payload), secret_key);
Below is HMAC SHA 256 token:
Red is Header
Blue is payload
The last one is the signature.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYWRtaW4iLCJuYW1lIjoiSm9obiBEb2UiLCJleHBpcmVBdCI6MTUxNjIzOTAyMn0.f6wsQSs6Z7zk94B7Y6RskvUb1RLBkenl3oAzzwRneNk
Reference: Validate your JWT token here. https://jwt.io/
Comments
Post a Comment