Node.js Backend Development Bootcamp · 课时

JWT 令牌生成与验证

理解 JSON Web 令牌（JWT），并实现其生成和验证，以确保 API 访问安全。

JWT 令牌生成与验证 是 CoddyKit 上的免费 Node.js Backend Development Bootcamp 课时。这是第 2 节课，共 6 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Node.js Backend Development Bootcamp 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Node.js Backend Development Bootcamp 课程共包含 6 节课。

本课时的部分内容尚未翻译，以英文显示。

Intro to JWT: What & Why

Welcome! In this lesson, we'll dive into JSON Web Tokens (JWTs), a popular way to secure APIs.

A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. Think of it as a digital ID card for your API.

Why Use JWTs for APIs?

JWTs offer several advantages for modern web and mobile APIs:

Statelessness: The server doesn't need to store session information. Each request carries the user's authentication details.
Scalability: Easier to scale applications horizontally as there's no shared session state across servers.
Security: If implemented correctly, JWTs provide a secure way to verify user identity and prevent tampering.

JWT Structure: Three Parts

A JWT is a string made of three parts, separated by dots (.). Each part is Base64Url-encoded:

HEADER.PAYLOAD.SIGNATURE

Let's break down what each of these parts means and why they're important for security.

The JWT Header

The Header typically consists of two parts:

alg (Algorithm): Specifies the cryptographic algorithm used for signing the token (e.g., HS256, RS256).
typ (Type): Indicates that the token is a JWT.

Example (Base64Url-decoded):

{"alg": "HS256", "typ": "JWT"}

The JWT Payload (Claims)

The Payload contains the "claims" – statements about an entity (like a user) and additional data.

Claims can be:

Registered: Standard fields like iss (issuer), exp (expiration time), sub (subject).
Public: Custom claims registered in the IANA JWT Registry.
Private: Custom claims agreed upon by the sender and receiver.

Example Payload:

{"sub": "user123", "name": "Alice", "exp": 1678886400}

The JWT Signature

The Signature is crucial for verifying the token's authenticity and integrity. It ensures the token hasn't been tampered with.

It's created by taking the encoded header, the encoded payload, a secret key, and the algorithm specified in the header, then signing them.

Formula (simplified):

HMACSHA256(encodedHeader + "." + encodedPayload, secretKey)

Python: Generating a JWT

Let's generate a JWT using Python's PyJWT library. First, install it: pip install PyJWT.

We define a payload with an expiration time and a secret key.

import jwt
import datetime

def main():
    SECRET_KEY = "your-super-secret-key"

    # Define payload with some claims
    payload = {
        "sub": "user123",
        "name": "Alice",
        "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=30),
        "iat": datetime.datetime.utcnow()
    }

    # Encode the token
    token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
    print(f"Generated JWT: {token}")

if __name__ == "__main__":
    main()

Secret Keys & Security

The SECRET_KEY used to sign and verify JWTs is extremely important. If this key is compromised, an attacker could forge valid tokens, granting unauthorized access.

Always use a strong, randomly generated key.
Never hardcode it in your application; use environment variables or a secure key management service.
Keep it absolutely confidential!

Python: Validating a JWT

To validate a JWT, you decode it using the same secret key and algorithm. PyJWT automatically verifies the signature and checks claims like expiration (`exp`).

import jwt
import datetime
import time

def main():
    SECRET_KEY = "your-super-secret-key"

    # Generate a token to validate (short expiry for demo)
    payload_gen = {
        "sub": "user123",
        "name": "Bob",
        "exp": datetime.datetime.utcnow() + datetime.timedelta(seconds=5), 
        "iat": datetime.datetime.utcnow()
    }
    token_to_validate = jwt.encode(payload_gen, SECRET_KEY, algorithm="HS256")
    print(f"Token to validate: {token_to_validate}\n")
    time.sleep(1) # Wait a bit for demonstration

    # Attempt to decode/validate it
    try:
        decoded_payload = jwt.decode(token_to_validate, SECRET_KEY, algorithms=["HS256"])
        print("Token is valid!")
        print(f"Decoded Payload: {decoded_payload}")
    except jwt.ExpiredSignatureError:
        print("Token has expired!")
    except jwt.InvalidTokenError:
        print("Invalid token (e.g., bad signature or format).")

if __name__ == "__main__":
    main()

JWT Best Practices

To keep your JWT implementation secure:

Set Expiration (exp): Always include an expiration claim to limit the window of a compromised token.
HTTPS: Always transmit JWTs over HTTPS to prevent eavesdropping.
Secure Storage: Store tokens securely on the client-side (e.g., HTTP-only cookies for web, secure storage for mobile).
Refresh Tokens: For long sessions, use short-lived access tokens and longer-lived refresh tokens.

Check Your Understanding

Review the components of a JWT. Which of the following parts is responsible for ensuring the token hasn't been tampered with?

Recap: JWT Essentials

In this lesson, we explored JSON Web Tokens (JWTs) for secure API authentication.

JWTs are compact, URL-safe tokens with a Header, Payload, and Signature.
The Header defines the token type and signing algorithm.
The Payload carries "claims" (data like user ID, roles, expiration).
The Signature verifies the token's integrity and authenticity.
We learned to generate and validate JWTs using Python's PyJWT library.
Always use strong, secret keys and set expiration times for security.

Next, we'll integrate JWTs into FastAPI using OAuth2 for a complete authentication flow!

常见问题解答

「JWT 令牌生成与验证」课时是免费的吗？

是的 — 「JWT 令牌生成与验证」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Node.js Backend Development Bootcamp 课程的其余内容，请升级到 CoddyKit PRO。 Node.js Backend Development Bootcamp 课程共包含 6 节课。

「JWT 令牌生成与验证」这节课中我会学到什么？

理解 JSON Web 令牌（JWT），并实现其生成和验证，以确保 API 访问安全。你通过在浏览器中直接运行的动手代码来练习 Node.js Backend Development Bootcamp，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Node.js Backend Development Bootcamp 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Node.js Backend Development Bootcamp 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 2 节课，共 6 节。

「JWT 令牌生成与验证」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Node.js Backend Development Bootcamp 课中编写并运行代码吗？

能。每节 Node.js Backend Development Bootcamp 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Node.js Backend Development Bootcamp