I'm sure you have used JWT many times but have you ever think about what it is
even though you have not used it maybe you have heard about JWT and in this
episode we are going to see what is JWT what it can do how it can be created
what the structure of JWT and all these things that means the JWT explained so
with that I'm your host Sarthak and this is a channel where I talk about web
development related things like Laravel Vuejs react angular and much more
exciting thing so if you are new to this channel don't for word subscribe and
like Bitfumes on Facebook Twitter and Instagram so let's start this video to
know more about JWT but first thing first what the JSON web token JWT is
it's an open standard open a standard this means anyone can use it and why it
is used it is used to securely transfer information between any two bodies and
two bodies that means any two users any two server any two bodies okay and why
it is used because it is digitally signed this means information is
verified and trusted there is no alteration of data in between the
transfer so that's why it is displace find and then comes the most important
part which is compact it is so compact that you can just send it via URL as
get requests then you can send this as a post request as a HTTP header and in
that way it's supremely fast that fast transmission makes JWT more usable and
that's why it is easily used it is self contained and what that self contained
means it means if that token that means the JWT token is self contained the
information about the user and this avoid querying the database more than
once suppose you have logged in or user your user just logged in one time
you verify the information like username password then you just provide a token
so every other time the user going to request something from your website you
don't have to log in you just have to pass that token and then JWT system will
just verify that token and if that passes give the information or respond
to that request that's the case of self contained a single token is having
everything in it but why JWT is useful JWT is useful in case of authentication
as I have just explained you it is used for exchanging information between any
two bodies as we have discussed okay but what a JSON web token structure will
look like you can see we have three parts the a part the B part and the C
parts the a part is actually the header header part then we have concatenated
the B part which is called payload and again the last one is the signature
let's first understand header and then we will proceed
so what header includes header will look like this it's a JSON object simple and
it includes two fields and one is a LG simply algorithm algorithm like H Mac
sha-256 RSA this means this a LG will tell the JWT that in which algorithm it
is encoded then comes Eve IP that means the type type of web token which is
simply JWT this jason and this header jason is then
base64 encoded to form the first part we have seen let's see this the first part
the a part we have here and this a part then encoded in the form of base64 to
form the first part the a part okay then comes the payload payload again have a
structure itself JSON object simply and it contains the claims
and what is claims? claims are the user detail or additional metadata like
expiry date of the token is that admin or not other things then payload itself
then base64 encoded to form the second part the be part of the JWT then comes
the most important part which is signature five year using signature we
told the JWT that in the header yeah we are going to use this kind of token and
you have to encode this with this time of algorithm then we have told the GWT
that these are the fields I am going to pass these are the things which you
self-contained but how we will ensure that this data
will not change while transferring to one body to other body so here comes the
signature signature uses base64 header then concatenate with base64 version of
payload and all these things then HMac sha-256 encoded this contain base64
header base64 payload with a secret and this important thing because if someone
even changed the payload he don't know about the secret and then this signature
will not exactly the same with the original payload and if you are confused
I will show you this in just a moment this provide the signature provide more
security so after combining all these three
things we get our JWT combined with a dot the first one the base64 version of
header then the second one base64 version of payload then the third one
base64 of header dot base64 of payload then secret all these things ashmac
sha-256 encoded to form the signature this last one so this is actually the
JWT and let's explain this you have a browser and you have a
then from the browser you send a post request to the server with the
credential like the username and password then server catch that verified
that authenticate that and if everything good JWT
is generated with a secret and then that passed back to the browser if we get a
successful JWT then we will send the JWT on the header on the post request on URL
to access some protected resources on our website then on the server first we
check about the JWT if JWT signature matches with the signature we have
defined then it is you the information that everything is good and you can
access this protected field and respond to the client if signature doesn't
matter it will just say an authenticated so these are the things you have to
learn about JWT but let's go to this JWT.io website
and let's see what will going to happen if we change something on this website
so we have this JWT all these things this is the header part the payload and
the secret but what if I alter this if I remove this mind you can see it says
invalid signature that's good because we have changed and coded part but what if
in between the transmission someone changed the payload and then he put that
base encoded part of the new payload here so let's just copy this one from
here go to new tab and I will say base64 encode online go here on the encode part
I will paste that and instead of true I will say false
and let's encode it copy this encode part base64 and
now let's see here signature is verified because everything is good this
signature is created with admin as a true but if I change this payload base64
it become false but now it says invalid because signature is created with admin
as a true and new payload has admin as a false this means signature is not
verified with the payload so now let's play with secret we have done changes in
the payload so if I'd say a true signature verified but what I gave wrong
secret so if I remove T you can see even though payload is correct
the signature doesn't match --is this means this time I have changed the
signature so if I give single till at last you can see signature verifies and
this is the cool part of using JWT and in that way JWT simply works so let me
know what you think about JWT whether you are using it whether you are not
using it whatever thing just comment below on this video so that everyone's
so so that we have a healthy discussion on the JWT if you have any doubt feel
free to message me commit me on Facebook Twitter and Instagram you can email me
and don't forget to subscribe like bitfumes on Facebook Twitter and Instagram
bye bye