JSON Web Token
A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
Secure APIs
A JSON Web Token is a compact, URL-safe token format for representing claims that can be digitally signed or encrypted.
- How it is used
- Authorizes API requests by carrying signed claims about a user or nonhuman subject’s rights, scopes, role, or identity.
- How deep it goes
- Explains structure, token distinctions, issuance choices, validation failures, and testing implications without detailing complete validation code.
- Examples
- Uses Python PyJWT payloads, HS256 and PS256 issuance, unsigned or expired tokens, and token-tampering security tests.
- What you can do after
- Evaluate JWT designs, issue tokens with PyJWT, and test validation failures such as tampering, algorithm confusion, expiry, and privilege escalation.
ASP.NET Core in Action, 3e
A JSON Web Token, or JWT, is a compact, signed token format for representing claims between parties.
- How it is used
- Protects ASP.NET Core API endpoints by carrying claims in a bearer token that authentication middleware validates.
- How deep it goes
- Explains token structure, signature checks, middleware behavior, minimal API setup, and local testing; leaves production token issuance to an identity provider.
- Examples
- Uses a decoded JWT, a protected minimal API endpoint, and locally generated tokens sent in an Authorization header.
- What you can do after
- Operate/configure JWT bearer authentication in an ASP.NET Core API and test a protected endpoint with dotnet user-jwts.
Read how ASP.NET Core in Action, 3e explains JSON Web Token →
Spring Security in Action, Second Edition
A JSON Web Token is a compact token format that represents claims as a digitally signed or otherwise protected JSON-based value.
- How it is used
- Carries authorization claims from an OAuth 2 authorization server to a resource server for authentication and access control.
- How deep it goes
- Explains the three-part structure, visibility, signature validation, Spring configuration, key retrieval, and endpoint testing.
- Examples
- Uses a three-part token sample, Spring configuration, a /demo endpoint, public-key metadata, and a Bearer-token curl request.
- What you can do after
- Build it from scratch by configuring Spring Security to validate JWTs against an authorization server’s public key set.
Read how Spring Security in Action, Second Edition explains JSON Web Token →
Effective Platform Engineering
A JSON Web Token is a compact, signed token format for conveying claims between parties.
- How it is used
- Carries identity and team-membership claims from an IDP to support access to platform resources.
- How deep it goes
- Works through claim sourcing and a device-authorization flow, but does not detail JWT format or verification internals.
- Examples
- Uses a GitHub-authenticated CLI flow and an Auth0 configuration exercise that adds GitHub teams to a verifiable JWT.
- What you can do after
- Apply it via GitHub and Auth0 to produce a verifiable JWT containing a user’s team membership after authentication.
Read how Effective Platform Engineering explains JSON Web Token →
.NET in Action, Second Edition
A JSON Web Token is a compact, URL-safe token format for conveying claims between parties, commonly with a digitally signed or authenticated representation.
- How it is used
- Uses JWT bearer tokens to authenticate web API requests before authorization policies decide endpoint access.
- How deep it goes
- Explains token parts and selected claims, then configures bearer authentication and claim-based authorization; leaves OpenID Connect history aside.
- Examples
- Inspects a Swagger UI request’s bearer token and uses ASP.NET Core listings for middleware, action policies, and a claim-checking handler.
- What you can do after
- Apply it via ASP.NET Core JWT bearer authentication and authorization policies, and inspect token claims without casually exposing a live token.
Read how .NET in Action, Second Edition explains JSON Web Token →
.NET MAUI in Action
A JSON Web Token is a compact, signed token format for representing claims exchanged between parties.
- How it is used
- Authenticates calls from a .NET MAUI app to protected API resources after browser-based identity-provider sign-in.
- How deep it goes
- Explains the acquisition flow and configuration but stops short of detailing JWT claim structure or signature validation.
- Examples
- Uses MauiStockTake authentication with IdentityServer, LoginAsync, a custom redirect scheme, and platform URL-registration files.
- What you can do after
- Operate/configure a .NET MAUI authentication service that obtains a JWT through an OIDC-compliant identity provider.
Software Security for Developers
JSON Web Token is a compact, URL-safe format for representing claims that can be transmitted between parties.
- How it is used
- Uses JSON claims and signatures to package access, identity, and authorization information across OAuth 2/OIDC interactions.
- How deep it goes
- Explains structure, claims, validation, expiration, standards relationships, and alg:none risk without developing public-key cryptography.
- Examples
- Shows a three-part token, decoded header and payload JSON, subject claims, short expiration, and an alg:none tampering scenario.
- What you can do after
- Diagnose JWT structure, verify signatures, interpret claims, and configure libraries to reject insecure algorithm choices.
Read how Software Security for Developers explains JSON Web Token →
Building Web APIs with ASP.NET Core
JSON Web Token (JWT) is a compact, claims-based token format for securely transmitting information between parties.
- How it is used
- Secures account login and prepares an ASP.NET Core API for restricting data-changing operations to authorized users.
- How deep it goes
- Explains controller wiring, credential verification, signing-key configuration, token creation, and endpoint testing without detailing token validation internals.
- Examples
- Uses RegisterDTO, LoginDTO, /Account/Register, /Account/Login, SwaggerUI, configured signing credentials, and concrete validation responses.
- What you can do after
- Build JWT-backed registration and login endpoints with ASP.NET Core Identity and verify them through SwaggerUI.
Read how Building Web APIs with ASP.NET Core explains JSON Web Token →
Spring in Action, Sixth Edition
A JWT is a compact, signed or encrypted JSON-based token format for conveying claims between parties.
- How it is used
- Secures REST API requests by carrying authenticated identity and permission scopes from a client to a resource server.
- How deep it goes
- Explains claims, scope checks, signature verification, and Spring configuration, but does not detail JWT encoding or encryption internals.
- Examples
- Demonstrates Taco Cloud ingredient creation and deletion through curl requests carrying scoped Bearer tokens.
- What you can do after
- Operate/configure a Spring resource server that validates JWTs and authorizes endpoints using OAuth 2 scopes.
Read how Spring in Action, Sixth Edition explains JSON Web Token →
Go in Practice, Second Edition
A JSON Web Token is a signed token format for transmitting claims between parties, commonly including identity information.
- How it is used
- Uses signed claims to preserve identity across HTTP and websocket interactions without relying solely on cleartext cookies or session identifiers.
- How deep it goes
- Defines claims and demonstrates Go signing with HS256, registered timestamps, and a subject, while deferring custom cryptographic implementation.
- Examples
- Demonstrates a real-time chat identity problem and a Go token containing subject, expiration, issue-time, and not-before claims.
- What you can do after
- Apply it via the golang-jwt/jwt library to generate signed identity tokens with registered claims.
Read how Go in Practice, Second Edition explains JSON Web Token →
Grokking Web Application Security
A JSON Web Token is a compact, digitally signed token format that carries claims about a subject, such as a user's profile information.
- How it is used
- Carries authenticated session state and credentials across services, including OpenID Connect profile information.
- How deep it goes
- Defines JWTs and explains signing, validation, transport, readability, and XSS risks without detailing token internals.
- Examples
- Uses Node.js token signing, a Bearer Authorization request, and a Facebook OpenID sign-on flow.
- What you can do after
- Operate/configure JWT-based sessions by signing tokens, validating them at each service, and limiting client-side exposure.
Read how Grokking Web Application Security explains JSON Web Token →
Related concepts
- OpenID Connect ID tokenincludes · An OpenID Connect ID token is a signed token containing claims about an authenticated end user, the authentication event, and the client for which it was issued.
- cookiealternative to · An HTTP cookie is a small piece of data that a server asks a user agent to store and return with subsequent requests within its scope.
- claimhas part · A claim is an assertion or formal demand concerning a subject, fact, right, or loss.
- authenticationused by · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- opaque tokenalternative to · An opaque token is an access token whose contents are not directly interpretable by its recipient, typically requiring server-side validation or lookup.
- JWT headerhas part · A JWT header is the JSON-encoded metadata section of a JSON Web Token that typically identifies its type, signing algorithm, and key.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.