ความปลอดภัยโดยใช้ JWT

Welcome to the final lesson on Spring Security! Today, we'll explore JSON Web Tokens (JWTs), a popular method for securing stateless APIs.

Unlike traditional session-based authentication, JWTs allow the server to remain stateless, making them ideal for microservices and mobile applications.

A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object.

• Compact: Small size, can be sent through URL, POST parameter, or inside an HTTP header.
• Self-contained: Contains all necessary information about the user, avoiding database lookups for every request.

A JWT consists of three parts, separated by dots (.):

• Header
• Payload
• Signature

It typically looks like: xxxxx.yyyyy.zzzzz

The Header usually consists of two parts: the type of the token (which is JWT) and the signing algorithm being used (e.g., HS256 or RS256).

This JSON is then Base64Url-encoded to form the first part of the JWT.

The Payload contains the 'claims' – statements about an entity (typically, the user) and additional data. There are three types of claims:

• Registered claims: Standard, non-mandatory claims (e.g., iss for issuer, exp for expiration, sub for subject).
• Public claims: Defined by users, require collision-resistant names.
• Private claims: Custom claims agreed upon by sender and receiver.

The Signature is created by taking the encoded header, the encoded payload, a secret key, and the algorithm specified in the header. It ensures the token hasn't been tampered with.

If someone changes the header or payload, the signature verification will fail, making the token invalid. The secret key must be kept confidential!

Let's see how the header and payload are Base64Url-encoded. The signature would then be computed using these encoded parts and a secret.

When a user successfully authenticates (e.g., logs in with username/password), the server:

1. Generates a JWT.
2. Sends the JWT back to the client.

For subsequent requests, the client:

1. Stores the JWT (e.g., in local storage).
2. Attaches the JWT in the Authorization header (e.g., Bearer YOUR_TOKEN).

The server then intercepts and validates this token for each protected request.

A custom filter in Spring Security would extract the token, decode its parts, and then critically, verify the signature and validate claims like expiration.

Based on what we've learned, which of the following are standard parts of a JSON Web Token (JWT) that are transmitted?

In this lesson, we explored JWT-based security, understanding its three key parts: Header, Payload, and Signature.

We learned how JWTs enable stateless authentication, making them highly scalable and suitable for modern APIs and mobile applications. You also saw conceptual code examples for generating and validating JWTs.

This concludes our Spring Security course! You've learned to secure applications from basic authentication to advanced token-based systems.