PricingLoginStart free
Spring Security 6 & JWT Authentication · Lección

Firma y verificación de JWT

Aprenda los principios criptográficos en los que se basa la firma de JWT y cómo verificar la integridad y autenticidad de un token.

Lección 3 de 411 pasos

Firma y verificación de JWT es una lección gratuita de Spring Security 6 & JWT Authentication en CoddyKit. Esta es la lección 3 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Security 6 & JWT Authentication, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

What is JWT Signing?

JSON Web Tokens (JWTs) are powerful, but how do we trust them? Signing is the answer! It's a cryptographic process that ensures a token hasn't been tampered with and comes from a trusted source.

  • Integrity: Confirms the token's content hasn't been changed since it was issued.
  • Authenticity: Verifies the token was issued by the expected sender.

Without a signature, anyone could create or alter a JWT!

Keys to Security: The Secret

For symmetric signing algorithms like HMAC (e.g., HS256), a single secret key is used. This key is known only to the issuer and the intended verifier(s).

  • The secret key is a string of bytes, crucial for both signing and verifying.
  • It must be kept highly confidential.
  • If the secret key is compromised, your JWTs are no longer secure!

Algorithms: HS256 & RS256

JWTs use cryptographic algorithms to create the signature. The algorithm type is specified in the token's header.

  • HS256 (HMAC SHA-256): A symmetric algorithm. Uses a single secret key for both signing and verification. Simpler to implement.
  • RS256 (RSA SHA-256): An asymmetric algorithm. Uses a private key for signing and a public key for verification. More complex but better for distributed systems.

We'll focus on HS256 for our examples due to its simplicity.

Building the Signature (HS256)

The signature is created by combining the Base64Url encoded header, the Base64Url encoded payload, and your secret key using the chosen algorithm.

  1. Take the Base64Url encoded header.
  2. Take the Base64Url encoded payload.
  3. Concatenate them with a dot: encodedHeader + "." + encodedPayload.
  4. Hash this combined string using HMAC SHA-256 with your secret key.
  5. Base64Url encode the resulting hash to get the final signature.

Result: encodedHeader.encodedPayload.signature

Code: Generating HS256 Signature

Here's a Java example to generate an HS256 signature for a JWT. Notice how the secret key is essential for the hashing process.

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class JwtSigner {
    public static void main(String[] args) throws Exception {
        String encodedHeader = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"; // {"alg":"HS256","typ":"JWT"}
        String encodedPayload = "eyJpZCI6MSwicm9sZSI6InVzZXIifQ";     // {"id":1,"role":"user"}
        String secret = "coddykit-secret-lesson-key-1234567890";

        String dataToSign = encodedHeader + "." + encodedPayload;

        Mac hmacSha256 = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256");
        hmacSha256.init(secretKey);

        byte[] signatureBytes = hmacSha256.doFinal(dataToSign.getBytes("UTF-8"));
        String encodedSignature = Base64.getUrlEncoder().withoutPadding().encodeToString(signatureBytes);

        System.out.println("Data to Sign: " + dataToSign);
        System.out.println("Generated Signature: " + encodedSignature);
        System.out.println("Full JWT: " + dataToSign + "." + encodedSignature);
    }
}

Verifying a JWT's Signature

Verification is the reverse process of signing. When you receive a JWT, you need to ensure its signature is valid.

  1. Separate the received JWT into its three parts: header, payload, and signature.
  2. Reconstruct the "data to sign" string: encodedHeader + "." + encodedPayload.
  3. Using the same secret key and algorithm, calculate a new signature from this data.
  4. Compare your newly calculated signature with the signature provided in the JWT.

If they match, the token is valid and untampered! If not, it's invalid.

Secure Key Management

The security of your JWTs critically depends on how well you manage your signing keys. A compromised key invalidates all your security efforts!

  • Confidentiality: Keep secret keys private. Never hardcode them in client-side code.
  • Rotation: Regularly change your keys to limit the impact of a potential compromise.
  • Strength: Use strong, random, and sufficiently long keys.
  • Store keys in secure environments, like environment variables or dedicated key management services.

Code: Verifying HS256 Signature

This example demonstrates how to verify a JWT's signature. We use the same secret key to recalculate the signature and compare it against the one in the token.

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class JwtVerifier {
    public static void main(String[] args) throws Exception {
        String jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6InVzZXIifQ.qS6pQ_6_q-P_5_o-O_6_n-N_7_m-M_8_l-L_9_k-K_0_j-J_1_i-I_2_h-H_3_g-G_4_f-F_5_e-E_6_d-D_7_c-C_8_b-B_9_a-A"; 
        String secret = "coddykit-secret-lesson-key-1234567890";

        String[] parts = jwt.split("\\.");
        String encodedHeader = parts[0];
        String encodedPayload = parts[1];
        String receivedSignature = parts[2];

        String dataToSign = encodedHeader + "." + encodedPayload;

        Mac hmacSha256 = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256");
        hmacSha256.init(secretKey);

        byte[] calculatedSignatureBytes = hmacSha256.doFinal(dataToSign.getBytes("UTF-8"));
        String calculatedSignature = Base64.getUrlEncoder().withoutPadding().encodeToString(calculatedSignatureBytes);

        if (calculatedSignature.equals(receivedSignature)) {
            System.out.println("Signature is VALID!");
        } else {
            System.out.println("Signature is INVALID!");
            System.out.println("Received: " + receivedSignature);
            System.out.println("Calculated: " + calculatedSignature);
        }
    }
}

Symmetric vs. Asymmetric Signing

While HS256 (HMAC SHA-256) uses a shared secret, RS256 (RSA SHA-256) and ES256 (ECDSA SHA-256) use key pairs.

  • Symmetric (e.g., HS256): Same key for signing and verifying. Best for single-service applications or when the verifier is also the issuer.
  • Asymmetric (e.g., RS256, ES256): Private key for signing, public key for verifying. Ideal for distributed systems where multiple services need to verify tokens issued by a central authority. The public key can be shared widely without compromising security.

Quick Check: JWT Security

You've learned about JWT signing and verification. Let's test your understanding.

Responde en la lección interactiva

Recap: Secure JWTs

Great job! We've demystified how JWTs are secured through signing and verification.

  • Signing ensures a JWT's integrity and authenticity using a cryptographic algorithm and a secret key.
  • HS256 (HMAC SHA-256) is a symmetric algorithm using a single shared secret.
  • Verification involves recalculating the signature and comparing it to the received one.
  • Secure key management is paramount for JWT security.
  • Asymmetric algorithms like RS256 use key pairs for distributed verification.

Next up, we'll see how to integrate JWTs with Spring Security!

Gratis para empezar

Aprende Java con un tutor de IA — gratis

Escribe y ejecuta código real en tu navegador, obtén ayuda instantánea de un tutor de IA disponible 24/7 y continúa donde lo dejaste en la web o en la aplicación.

Cursos
12
Lecciones
48
Empezar a aprender gratisVer el curso completo

Preguntas frecuentes

¿La lección «Firma y verificación de JWT» es gratis?

Sí — el texto completo de «Firma y verificación de JWT» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Security 6 & JWT Authentication, actualiza a CoddyKit PRO. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

¿Qué aprenderé en «Firma y verificación de JWT»?

Aprenda los principios criptográficos en los que se basa la firma de JWT y cómo verificar la integridad y autenticidad de un token. Practicas Spring Security 6 & JWT Authentication con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Spring Security 6 & JWT Authentication?

No se requiere experiencia previa. Spring Security 6 & JWT Authentication en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 3 de 4.

¿Cuánto tiempo toma la lección «Firma y verificación de JWT»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Spring Security 6 & JWT Authentication?

Sí. Cada lección de Spring Security 6 & JWT Authentication incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

  1. Comprensión de los JSON Web Tokens
  2. Estructura y claims de los JWT
  3. Firma y verificación de JWT
  4. Expiración de JWT y reglas de validación
← Volver a Spring Security 6 & JWT Authentication