🎟️
JSON Web Token (JWT)
Session Management
Signed token format (often used as bearer tokens) carrying claims like issuer, subject, audience, and expiry.
Definition
JWTs are a standard token format that can be signed (JWS) and sometimes encrypted (JWE). They carry “claims” such as issuer, audience, subject, and expiration. Validation must check signature, issuer/audience, time claims, and algorithms.
In plain English
Signed token format (often used as bearer tokens) carrying claims like issuer, subject, audience, and expiry.
Why this matters
Why it matters: Weak validation or long-lived tokens increase impersonation risk and privacy exposure.
Example
Example: Accept only expected algorithms, verify signature with pinned keys, enforce short expiry, and rotate signing keys.