A JSON Web Token (JWT, pronounced “jot”) is a compact JSON data structure used to carry session state or user profile information. It is digitally signed so a recipient can check that its contents were not altered, but signing does not make its contents secret. section 9.4 section 9.10
JWTs are useful when one authenticated web application calls multiple microservices. Each service can verify a token’s authenticity without asking the original authentication service, reducing repeated authentication lookups. A JWT can also act as the profile-bearing token returned through OpenID Connect on top of OAuth. section 9.4 section 8.3
Create a signed token
A Node.js application can sign a small payload such as a user ID and role with a secret key. The receiving service must validate that signature before treating the token as authentication credentials; decoded content is untrusted until then. section 9.4 section 9.10
Treat JWTs as client-side session data with specific safeguards:
- Validate the digital signature in every microservice that accepts the token; rejecting altered tokens prevents a user from changing claims such as a username. section 9.10
- Do not put secrets or private session details in a signed JWT, because the client can read signed content. section 9.10 section 9.11
- Avoid exposing tokens to client-side JavaScript when possible. Sending a JWT in a Cookie marked HttpOnly reduces theft through cross-site scripting; session cookies should also use Secure over HTTPS. section 9.4 section 9.11
- Use signing or encryption to tamperproof client-side sessions and JWTs, and keep the session-management framework patched. section 9.11
const tokens = require('jsonwebtoken');
const payload = { userId: '123456789', role: 'admin' };
const secretKey = process.env.SECRET_KEY;
const jwt = tokens.sign(payload, secretKey);
This minimal Node.js example signs a JSON payload with a secret key, illustrating the difference between token claims and the signature that protects them. section 9.4
