Security

JSON Web Token (JWT)

A compact, signed token format with three parts: a header naming the signing algorithm, a payload of identity and authorization claims, and a signature over both. The claims are readable by anyone, so the signature check is the only thing that makes them trustworthy.

Deep dive

Learn Article

How JWT Algorithm Confusion Lets a Forged Token Pass Signature Checks

A JWT verifier that lets the token choose the algorithm, or fails to reject one it does not recognize, will accept a token the attacker wrote. The failure shapes and what a correct verifier does.

intermediate 6 min read

Back to glossary