Web Technology Basics
Which of the following correctly describes a typical signed JWT (JSON Web Token)?
- AThe payload is encrypted with the signing key, so passwords or credit card numbers put in it cannot be read along the way
- BEven after a token has expired, the server must accept it as long as the signature is valid, because it has not been tampered with
- CIt consists of a header, a payload and a signature, each encoded with Base64URL and joined with "."; the signature detects tampering, but the contents are not encrypted
Show answer and explanation
Answer: C. It consists of a header, a payload and a signature, each encoded with Base64URL and joined with "."; the signature detects tampering, but the contents are not encrypted
A JWT has three parts, "header.payload.signature": the header holds the signature algorithm (for example HS256), and the payload holds information (claims) such as the user identifier and the expiry (exp). The signature is made from the header and payload with a secret key, so a server that receives the token can confirm that the contents have not been tampered with and who issued it. However, Base64URL is not encryption, and anyone can decode and read it, so no secret information is put in it. When sent to an API, the token is generally placed after Authorization: Bearer.
- A. The payload of a signed JWT is only encoded and can be read by anyone. Secret information is not put in it.
- B. Along with the signature, the server checks the expiry (exp) and rejects expired tokens.
- C. Correct. The signature detects tampering, but the contents are not encrypted.