What is JWT (JSON Web Token) used for?

JWT is used for secure transmission of information between parties in the form of a JSON object.

Main use cases:

• Authorization: After successful authentication, the server generates a JWT containing user information and sends it to the client. For subsequent requests, the client sends this token to the server, which can verify its authenticity and retrieve user data without re-authentication.
• Information exchange: Can be used for exchanging data between microservices or different system components, ensuring the integrity and authenticity of the transmitted information.

The structure of JWT consists of three parts separated by dots:

1. Header: Contains the token type (JWT) and encryption algorithm (e.g., HS256, RS256).
2. Payload: Contains claims - information about the entity (usually the user) and additional metadata. Claims can be standard (registered claims), public (public claims), and private (private claims).
3. Signature: Created by hashing the encoded header and payload with a secret key. This allows verifying the token's integrity and ensuring it has not been altered.

Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c