JWT (JSON Web Token) Authentication and Authorization

What is JWT?

JWT (JSON Web Token) is a compact, URL-safe standard (RFC 7519) for securely transmitting information between parties as a JSON object. It is widely used for stateless authentication and session management in modern web applications, APIs, SPAs, and microservices.

How JWT Works for Sessions / Authentication

Instead of storing session data on the server (traditional sessions), the server issues a self-contained token after login. The client sends this token with every request. The server verifies the token's signature and trusts the claims inside it — no database lookup needed for basic validation.

Typical Flow

• Login: User logs in with credentials.
• Token Issuance: Server validates credentials and issues a signed JWT.
• Client Storage: Client stores the JWT (usually in memory, httpOnly cookie, or carefully in localStorage).
• Authenticated Requests: Client includes the JWT in subsequent requests (usually Authorization: Bearer <token>).
• Server Validation: Server verifies signature + claims → grants access.
• Token Expiry: When the token expires, use a Refresh Token to get a new one.

JWT Structure

A JWT consists of three parts: Header, Payload, and Signature, separated by dots (.) and each part is Base64Url-encoded.

Header: Contains metadata about the token, such as the signing algorithm and token type.

Common algorithms: HS256 (symmetric), RS256/ES256 (asymmetric — recommended for most cases).

Payload: Contains the claims (data) you want to transmit. This can include user information, roles, permissions, and custom data.

Signature: Created by signing the header and payload with a secret key (HMAC) or a private key (RSA/ECDSA). This ensures the token's integrity and authenticity.

Benefits of JWT

• Stateless & Scalable: No server-side session storage.
• Self-contained: All necessary info travels with the token.
• Cross-origin friendly: Works great with mobile apps and third-party domains.
• Performance: Fast verification.
• Standardized: Supported by most languages and frameworks.

Security Vulnerabilities & Best Practices

JWTs are powerful but easy to misconfigure. Here are the most critical points:

• Use strong asymmetric algorithms (RS256, ES256) instead of HS256 in most production scenarios.
• Always validate the algorithm on the server — never let the client dictate it (prevents "alg:none" and algorithm confusion attacks).
• Short-lived access tokens (15 minutes or less) + long-lived refresh tokens.
• Store tokens securely:Prefer httpOnly + Secure + SameSite=Strict/Lax cookies for refresh tokens.
• Avoid localStorage for access tokens if possible (XSS risk).

Additional Security Measures:

• Validate all important claims: exp, iat, iss, aud, nbf, jti.
• Use strong, rotated signing keys stored in secret managers (not in code).
• Implement token revocation (blacklist with jti, or short expiry + refresh token rotation).
• Always use HTTPS.
• Minimal payload — only necessary claims.
• Use established libraries (never implement from scratch): jsonwebtoken (Node), PyJWT, jjwt (Java), etc.