Intermediate LevelREST APIs & Web Services
What is the internal structure of a JSON Web Token (Header, Payload, Signature)?
❓ Interview Prompt: Explain JWT components (`Header.Payload.Signature`), Base64Url encoding, HMAC-SHA256 (`HS256`) vs RSA-SHA256 (`RS256`), and verifying signatures.
A JSON Web Token (JWT) (RFC 7519) is a compact, URL-safe container for transferring claims statelessly:
3 Base64Url-Encoded Parts:
1
Header: Contains token type and signing algorithm: '{ "alg": "RS256", "typ": "JWT" }'.
2
Payload (Claims): Contains statement attributes ('sub', 'name', 'exp', 'roles').
3
Signature: Cryptographic signature generated by signing 'Base64(Header) + "." + Base64(Payload)' using a server secret (HS256) or private key (RS256).
•
Rule: Base64 is encoding, NOT encryption! Anyone can decode JWT payloads; signatures guarantee payload authenticity.
Code Implementation Example
typescript
import jwt from 'jsonwebtoken';
// Sign JWT payload using RS256 Private Key
const token = jwt.sign(
{ userId: 'usr_42', role: 'admin' },
privateKey,
{ algorithm: 'RS256', expiresIn: '15m' }
);
// Verify JWT payload using Public Key
const decoded = jwt.verify(token, publicKey, { algorithms: ['RS256'] });💡Signing and verifying RS256 asymmetric JWT tokens in TypeScript.
🎯 Interview Key Takeaway
JWT signatures guarantee payload integrity and authenticity; use RS256 asymmetric keys to verify tokens across microservices.
#JWT#Authentication#RS256#Intermediate
Back to all REST APIs & Web Services Questions→