Beginner LevelAuthentication & Authorization
What are the 3 parts of a JSON Web Token (JWT) and how is the signature validated?
❓ Interview Prompt: Explain JWT Base64URL encoding, Header, Payload claims, and cryptographic Signature verification.
A JSON Web Token (JWT) (RFC 7519) is an open standard for securely transmitting claims between parties as a compact, self-contained JSON object.
The 3 Dot-Separated Components:
$$\text{JWT} = \text{Header} + "." + \text{Payload} + "." + \text{Signature}$$
1
Header: Contains token type ('"JWT"') and signing algorithm (e.g. '"HS256"' or '"RS256"'). Base64Url encoded.
2
Payload: Contains claims (statements about the subject like 'sub', 'name', 'roles', 'exp'). Base64Url encoded.
3
Signature: Created by taking the Base64Url-encoded header and payload, and signing it using a secret or private key:
$$\text{Signature} = \text{HMACSHA256}(\text{Base64}(H) + "." + \text{Base64}(P), \text{secret})$$
Crucial Warning:
Base64Url encoding is NOT encryption! Anyone can decode and read JWT payload claims. The signature guarantees integrity, not confidentiality.
Code Implementation Example
typescript
import jwt from 'jsonwebtoken';
// 1. Sign JWT token on Auth Server
const token = jwt.sign(
{ sub: 'user_1042', role: 'admin' },
process.env.JWT_SECRET!,
{ expiresIn: '15m', algorithm: 'HS256' }
);
// 2. Verify JWT signature & expiration on Resource API Server
try {
const decoded = jwt.verify(token, process.env.JWT_SECRET!);
console.log('Valid Token Claims:', decoded);
} catch (err) {
console.error('Invalid Signature or Expired Token:', err);
}💡Signing and verifying JWT tokens using jsonwebtoken library.
🎯 Interview Key Takeaway
JWTs contain 3 Base64Url parts (Header, Payload, Signature); signatures verify token integrity but do not encrypt payload data.
#JWT#Structure#Signature#Base64#Beginner
Back to all Authentication & Authorization Questions→