0Pricing
AI Powered SaaS: Stripe + Auth + Billing + Deploy · レッスン

ログインとJWTの生成

セッション管理のためにJSON Web Tokens（JWT）を発行・管理するユーザーログインシステムを構築します。

「ログインとJWTの生成」はCoddyKit上の無料AI Powered SaaS: Stripe + Auth + Billing + Deployレッスンです。 これはレッスン2/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはAI Powered SaaS: Stripe + Auth + Billing + Deploy学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 AI Powered SaaS: Stripe + Auth + Billing + Deployコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Welcome to Login Systems

In the previous lesson, we learned about user registration and secure password hashing. Now, it's time to build the login system!

A login system allows authenticated users to access protected resources and personalize their experience within your SaaS application.

How Login Works (Overview)

When a user tries to log in, they typically provide a username (or email) and a password. Here's the basic flow:

  • The client (e.g., your mobile app) sends credentials to the server.
  • The server verifies these credentials against its stored user data.
  • If valid, the server grants access.

Verifying User Credentials

Upon receiving login credentials, your server needs to perform a crucial check:

  1. Find the user by their unique identifier (e.g., email or username).
  2. Retrieve the stored hashed password for that user.
  3. Compare the provided password (after hashing it with the same method) with the stored hashed password.

Never store passwords in plain text! Always hash and salt them, as we discussed in the registration lesson.

The Challenge: Stateless APIs

Modern APIs are often stateless, meaning the server doesn't remember previous requests from the same client. This makes APIs scalable but poses a challenge for user authentication.

How do we know if a user who just logged in is still authenticated on their next request without sending credentials every time?

Introducing JSON Web Tokens (JWT)

JSON Web Tokens (JWTs) are a compact, URL-safe means of representing claims to be transferred between two parties. They are perfect for stateless authentication.

Instead of server-side sessions, the server issues a JWT upon successful login. The client then stores this token and sends it with every subsequent request.

JWT Structure: Header

A JWT consists of three parts separated by dots: Header, Payload, and Signature.

The Header typically contains two parts:

  • typ (type of token, usually 'JWT')
  • alg (signing algorithm, e.g., 'HS256' for HMAC SHA256)

It's a JSON object, Base64Url-encoded.

{"alg":"HS256","typ":"JWT"}

JWT Structure: Payload (Claims)

The Payload contains the 'claims' – statements about an entity (usually the user) and additional data.

Claims can be:

  • Registered: Standard fields like sub (subject), exp (expiration time), iat (issued at time).
  • Public: Custom claims defined by you, but registered in the IANA JSON Web Token Registry.
  • Private: Custom claims agreed upon by the parties using them, like userId or role.

Example Payload:

{"sub":"12345","name":"Coddy User","exp":1700000000}

JWT Structure: Signature

The Signature is crucial for verifying the token's integrity. It's created by taking the encoded header, the encoded payload, and a secret key, then applying the algorithm specified in the header.

If anyone tries to tamper with the header or payload, the signature verification will fail, making the token invalid. The secret key is known only to the server.

Generating a JWT (Conceptual)

After successfully verifying a user's credentials, your server generates a JWT. This involves:

  1. Creating the Header and Payload JSON objects.
  2. Base64Url-encoding both.
  3. Concatenating them with a dot.
  4. Signing the combined string using a secret key and the chosen algorithm to produce the Signature.

The final JWT is EncodedHeader.EncodedPayload.Signature.

JWT Generation Example

While full JWT signing requires a library, we can demonstrate the Base64 encoding part of building a JWT string. This ensures the token is URL-safe.

import java.util.Base64;
import java.nio.charset.StandardCharsets;

public class Main {
  public static void main(String[] args) {
    String headerJson = "{\"alg\":\"HS256\",\"typ\":\"JWT\"}";
    String payloadJson = "{\"sub\":\"user123\",\"name\":\"Coddy User\"}";

    String encodedHeader = Base64.getUrlEncoder().withoutPadding().encodeToString(headerJson.getBytes(StandardCharsets.UTF_8));
    String encodedPayload = Base64.getUrlEncoder().withoutPadding().encodeToString(payloadJson.getBytes(StandardCharsets.UTF_8));

    System.out.println("Header (Base64Url-encoded):\n" + encodedHeader);
    System.out.println("\nPayload (Base64Url-encoded):\n" + encodedPayload);
    System.out.println("\nConceptual JWT structure: " + encodedHeader + "." + encodedPayload + ".[Signature]");
  }
}

Quick Check: JWT Parts

You've just learned about the three main parts of a JSON Web Token (JWT).

Recap: Login & JWTs

Great job! You've learned how a user login system works and the role of JSON Web Tokens (JWTs) in modern, stateless authentication.

  • Login involves verifying credentials against hashed passwords.
  • JWTs provide a stateless way to manage user sessions.
  • JWTs have three parts: Header, Payload, and Signature.
  • The Signature ensures the token's integrity.

Next, we'll explore how to use these JWTs to protect your API routes!

よくある質問

「ログインとJWTの生成」レッスンは無料ですか？

はい。「ログインとJWTの生成」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、AI Powered SaaS: Stripe + Auth + Billing + Deployコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 AI Powered SaaS: Stripe + Auth + Billing + Deployコースには全4レッスンが含まれています。

「ログインとJWTの生成」で何を学びますか？

セッション管理のためにJSON Web Tokens（JWT）を発行・管理するユーザーログインシステムを構築します。 ブラウザで直接実行するハンズオンコードでAI Powered SaaS: Stripe + Auth + Billing + Deployを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

AI Powered SaaS: Stripe + Auth + Billing + Deployを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのAI Powered SaaS: Stripe + Auth + Billing + Deployは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン2/4です。

「ログインとJWTの生成」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このAI Powered SaaS: Stripe + Auth + Billing + Deployレッスンでコードを書いて実行できますか？

はい。すべてのAI Powered SaaS: Stripe + Auth + Billing + Deployレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

  1. ユーザー登録とハッシュ化
  2. ログインとJWTの生成
  3. 保護されたルートとミドルウェア
  4. パスワードリセットとメール認証
← AI Powered SaaS: Stripe + Auth + Billing + Deployに戻る