-
Book Overview & Buying
-
Table Of Contents
Practical C# Projects with .NET
By :
In web security, you will sometimes want to restrict certain actions to those who can perform them. For example, in order for a user to look at decks they own, we need to know who the user is who is making the request.
One of the ways of authenticating users in web communication is through the use of a JWT. A JWT (pronounced jot, according to the official specification) is a string of letters and numbers split into three distinct regions that contains a publicly readable set of claims and issuance information.
JWTs look encrypted but are publicly readable. If you have a valid JWT, you can put it into a tool such as the jwt.io website to read the various pieces of information encoded in the token, as shown in Figure 5.5:

Figure 5.5 – jwt.io displaying a readout of a JWT from CardTrackerApi
The payload of a JWT contains a number of claims, such as the following: