JSON Web Token

As explained in Effective Platform Engineering

A JSON Web Token is a compact, signed token format for conveying claims between parties.

A JSON Web Token (JWT) is a compact, signed token for conveying claims between parties. In a platform login flow, it can carry a user’s identity and team membership so services receive the authorization data they need after authentication. section 4.3.3 section 7.3.2

Keep the identity provider (IDP) between the user and the source of authorization data, rather than making it the source of truth. Configure its authorization server to retrieve user attributes and include the relevant claims in the login result. Team membership is one possible permission boundary, not the only one. section 4.3.3

Team access from a CLI

A developer starts authentication in a terminal, completes the browser step through GitHub, and grants device authorization. The IDP uses the resulting GitHub access token to request the developer’s organization teams, then creates a verifiable JWT containing an ID token with that team list as a claim. A refresh token can also be included. section 7.3.2

Figure 7.9 In this authentication and authorization flow, the IDP acts just as a secure go-between. The user must authenticate through GitHub and grant their device authorization to receive a JSON Web Token.

Follow the division of work between the CLI, GitHub and the IDP: the IDP acts as a secure go-between before the user receives a JWT. section 7.3.2

For a repeatable implementation, configure the GitHub OAuth application and automate the Auth0 application configuration used by the CLI. Prefer an integrable OpenID Connect approach over tools that require tickets and manual role assignment: the token is useful only if obtaining the right claims remains a workable self-service experience. section 4.3.3 section 7.3.2

How Effective Platform Engineering covers it

How deep it goes

Works through claim sourcing and a device-authorization flow, but does not detail JWT format or verification internals.

Examples

Uses a GitHub-authenticated CLI flow and an Auth0 configuration exercise that adds GitHub teams to a verifiable JWT.

What it assumes

Assumes familiarity with terminal-based platform access and GitHub organizations while explaining why the device-authorization flow fits a CLI.

What you can do after

Apply it via GitHub and Auth0 to produce a verifiable JWT containing a user’s team membership after authentication.

How it connects

Connects JWTs to OpenID Connect, identity providers, authorization claims, team membership and OAuth 2.0 device authorization.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Secure APIsA JSON Web Token is a compact, URL-safe token format for representing claims that can be digitally signed or encrypted.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eA JSON Web Token, or JWT, is a compact, signed token format for representing claims between parties.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionA JSON Web Token is a compact token format that represents claims as a digitally signed or otherwise protected JSON-based value.
• 

  liveBookmanning.com
  .NET in Action, Second EditionA JSON Web Token is a compact, URL-safe token format for conveying claims between parties, commonly with a digitally signed or authenticated representation.
• 

  liveBookmanning.com
  .NET MAUI in ActionA JSON Web Token is a compact, signed token format for representing claims exchanged between parties.
• 

  liveBookmanning.com
  Software Security for DevelopersJSON Web Token is a compact, URL-safe format for representing claims that can be transmitted between parties.
• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreJSON Web Token (JWT) is a compact, claims-based token format for securely transmitting information between parties.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionA JWT is a compact, signed or encrypted JSON-based token format for conveying claims between parties.
• 

  liveBookmanning.com
  Go in Practice, Second EditionA JSON Web Token is a signed token format for transmitting claims between parties, commonly including identity information.
• 

  liveBookmanning.com
  Grokking Web Application SecurityA JSON Web Token is a compact, digitally signed token format that carries claims about a subject, such as a user's profile information.

Compare how 11 books explain JSON Web Token →

Related concepts

• OpenID Connect ID tokenincludes · An OpenID Connect ID token is a signed token containing claims about an authenticated end user, the authentication event, and the client for which it was issued.
• cookiealternative to · An HTTP cookie is a small piece of data that a server asks a user agent to store and return with subsequent requests within its scope.
• claimhas part · A claim is an assertion or formal demand concerning a subject, fact, right, or loss.
• authenticationused by · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• opaque tokenalternative to · An opaque token is an access token whose contents are not directly interpretable by its recipient, typically requiring server-side validation or lookup.
• JWT headerhas part · A JWT header is the JSON-encoded metadata section of a JSON Web Token that typically identifies its type, signing algorithm, and key.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.