Wiki.Quizz.vn

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== JWT ======

JWT is primarily used for:

  * Authentication
  * Authorization

JWT normally uses:

<code>
Digital Signatures
</code>

NOT encryption.

-----

====== What Is JWT? ======

JWT stands for:

<code>
JSON Web Token
</code>

Structure:

<code>
Header.Payload.Signature
</code>

Example:

<code>
xxxxx.yyyyy.zzzzz
</code>

-----

===== JWT Header =====

Contains metadata.

Example:

<code json>
{
  "alg": "HS256",
  "typ": "JWT"
}
</code>

Meaning:

  * JWT token
  * Uses HS256 algorithm

-----

===== JWT Payload =====

Contains claims.

Example:

<code json>
{
  "userId": 123,
  "role": "admin"
}
</code>

Common claims:

  * sub
  * exp
  * iss
  * aud
  * iat

-----

===== JWT Signature =====

Protects token integrity.

Conceptually:

<code>
Header + Payload
       ↓
      Sign
       ↓
   Signature
</code>

Purpose:

  * Detect modification
  * Verify issuer

-----

====== JWT Authentication Flow ======

===== Step 1 =====

User logs in.

<code>
Email + Password
</code>

-----

===== Step 2 =====

Server validates credentials.

-----

===== Step 3 =====

Server creates JWT.

<code>
Header
Payload
Signature
</code>

-----

===== Step 4 =====

Server returns token.

<code>
{
  "token": "eyJhbGciOi..."
}
</code>

-----

===== Step 5 =====

Client stores token.

Possible locations:

  * Cookie
  * Local Storage
  * Memory

-----

===== Step 6 =====

Client calls protected API.

<code>
Authorization: Bearer <token>
</code>

-----

===== Step 7 =====

Server verifies token signature.

If valid:

<code>
Access Granted
</code>

If invalid:

<code>
401 Unauthorized
</code>

-----

====== JWT Using HS256 ======

===== Algorithm Type =====

<code>
HS256
</code>

Uses:

<code>
ONE SECRET KEY
</code>

-----

===== Architecture =====

<code>
Secret Key
    |
    +--> Sign JWT
    |
    +--> Verify JWT
</code>

-----

===== Example =====

<code>
JWT_SECRET=abc123
</code>

Signing:

<code>
Sign(token, abc123)
</code>

Verification:

<code>
Verify(token, abc123)
</code>

-----

===== Advantages =====

  * Simple
  * Fast
  * Easy setup

-----

===== Disadvantages =====

All services need the same secret key.

If the secret leaks:

<code>
Anyone can generate valid JWTs.
</code>

-----

====== JWT Using RS256 ======

===== Algorithm Type =====

<code>
RS256
</code>

Uses:

<code>
PUBLIC KEY + PRIVATE KEY
</code>

-----

===== Architecture =====

<code>
Private Key → Sign JWT

Public Key  → Verify JWT
</code>

-----

===== Example =====

<code>
JWT_PRIVATE_KEY=/keys/private.pem

JWT_PUBLIC_KEY=/keys/public.pem
</code>

-----

===== Signing =====

<code>
Sign(token, Private Key)
</code>

Only owner can sign.

-----

===== Verification =====

<code>
Verify(token, Public Key)
</code>

Anyone with public key can verify.

-----

===== Advantages =====

  * Better for microservices
  * Private key remains isolated
  * Public key can be distributed safely

-----

===== Disadvantages =====

  * More complex
  * Slightly slower

-----

====== HS256 vs RS256 ======

^ Feature ^ HS256 ^ RS256 ^
| Keys | 1 | 2 |
| Type | Symmetric | Asymmetric |
| Sign | Secret Key | Private Key |
| Verify | Secret Key | Public Key |
| Complexity | Low | Medium |
| Performance | Fast | Slightly Slower |
| Enterprise Usage | Medium | High |

-----

====== Laravel JWT Configuration ======

===== HS256 Example =====

<code>
JWT_SECRET=my-secret-key
</code>

or

<code>
JWT_KEY=my-secret-key
</code>

This usually means:

<code>
HS256
</code>

Uses:

<code>
1 Secret Key
</code>

-----

===== RS256 Example =====

<code>
JWT_PRIVATE_KEY=/keys/private.pem

JWT_PUBLIC_KEY=/keys/public.pem
</code>

This usually means:

<code>
RS256
</code>

Uses:

<code>
2 Keys
</code>

-----

====== Important JWT Fact ======

JWT is usually:

<code>
SIGNED
</code>

JWT is usually NOT:

<code>
ENCRYPTED
</code>

Anyone can decode payload contents.

Example:

<code json>
{
  "userId": 123,
  "role": "admin"
}
</code>

Therefore do NOT store:

  * Passwords
  * API Secrets
  * Credit Card Numbers
  * Sensitive Personal Information

inside JWT payloads.

-----

====== Summary ======

<code>
Cryptography
│
├── Encryption
│   │
│   ├── Symmetric (1 Key)
│   │   └── AES
│   │
│   └── Asymmetric (2 Keys)
│       └── RSA Encryption
│
└── Digital Signatures
    │
    ├── Symmetric Signature
    │   └── HS256 JWT
    │
    └── Asymmetric Signature
        └── RS256 JWT
</code>

Memory Trick:

<code>
Encryption
= Hide Data

Signature
= Verify Data

HS256
= 1 Secret Key

RS256
= Private Key + Public Key

JWT
= Usually Signed
= Usually Not Encrypted
</code>