MeridianMERIDIAN

JSON Web Token

technology.cryptographic.jwt

JSON Web Token (JWT) in either compact serialisation. A JWS is three base64url-encoded segments separated by dots, header.payload.signature; an unsecured JWT (RFC 7519 section 6) ends in a dot with an empty signature. A JWE (RFC 7516) is five segments (header, encrypted key, initialization vector, ciphertext and tag), where the encrypted key may be empty. Used for authentication and information exchange.

Operations on this type: Parse nested values

Try a value

JSON Web Token's rule accepts it.

Reads it as eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Use it

Shell
finetype infer -i 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' --mode column
# → technology.cryptographic.jwt
DuckDB
SELECT ft_infer('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c');
-- → 'technology.cryptographic.jwt'
Cast template: {col} is your column
CAST({col} AS VARCHAR)

How finetype reads the samples

DuckDB 1.5.5 · finetype 0.6.66

ValueAs VARCHARheaderpayloadsignature
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5ceyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5ceyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQSflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXkeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXkeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.eyJhbGciOiJub25lIn0eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ
Standard

Pattern

Regular expression
^[A-Za-z0-9_-]{10,}\.(?:[A-Za-z0-9_-]{10,}\.(?:[A-Za-z0-9_-]{10,})?|[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{10,})$
ValueLengthShape
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c155matches
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk116matches
eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.115matches
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9-eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c155rejected: separator swapped

Background

Origin

The JSON Web Token is defined by RFC 7519, published in May 2015.[1] RFC 7519 was written by M. Jones, J. Bradley and N. Sakimura.[1] RFC 7519 is an Internet Standards Track document.[1] RFC 7519 describes a JWT as a compact, URL-safe means of representing claims to be transferred between two parties.[1] RFC 7519 suggests that JWT be pronounced the same as the English word "jot".[1]

The JWS Compact Serialization is defined in RFC 7515, JSON Web Signature, as the base64url-encoded protected header, payload and signature joined by periods.[2] RFC 7515 says the compact serialization is intended for space-constrained environments such as HTTP Authorization headers and URI query parameters.[2] RFC 7515 defines base64url as Base64 encoding with the URL- and filename-safe character set, with all trailing '=' characters omitted.[2]

RFC 7519 lists seven registered claim names: iss, sub, aud, exp, nbf, iat and jti.[1] RFC 7519 recommends that a JWT's "typ" header value be "JWT".[1] RFC 7519 registers the "application/jwt" media type.[1]

Use

The OpenID Connect Core 1.0 specification says the ID Token is represented as a JSON Web Token (JWT).[3] RFC 9068 defines a profile for issuing OAuth 2.0 access tokens in JSON Web Token (JWT) format.[4] jwt.io says clients typically send a JWT in the Authorization header using the Bearer schema.[5]

jwt.io advises against putting secret information in the payload or header of a JWT unless it is encrypted.[5] jwt.io states that tokens are credentials, so great care must be taken to prevent security issues.[5]

RFC 7519 defines an Unsecured JWT as a JWS using the "alg" header parameter value "none".[1] RFC 8725, JSON Web Token Best Current Practices, warns that an attacker can change the algorithm to "none".[6] RFC 8725 says libraries must enable the caller to specify a supported set of algorithms.[6]

Sources

  1. [1]RFC 7519: JSON Web Token (JWT)standard
  2. [2]RFC 7515: JSON Web Signature (JWS)standard
  3. [3]OpenID Connect Core 1.0 incorporating errata set 2standard
  4. [4]RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokensstandard
  5. [5]JSON Web Token Introduction - jwt.iosecondary source
  6. [6]RFC 8725: JSON Web Token Best Current Practicesstandard

How it's detected

Each JWS segment, and the header, initialization vector and tag of a JWE, is at least 10 base64url chars to distinguish from other dot-separated formats. Header typically starts with "eyJ" (base64 for '{"'). Decompose reads the three JWS parts; the signature of an unsecured JWT is ''. A five-part JWE is not split (its parts are header, encrypted key, initialization vector, ciphertext and tag), so its payload and signature read ''. Discrimination counts a JWE or an unsecured JWT only when its header decodes to a JSON object with an "alg" member. An empty signature is accepted for any "alg", because logs often redact signatures, although RFC 7515 allows it only with "alg": "none".

Schema

https://meridian.online/schemas/technology.cryptographic.jwt · Frictionless type string

finetype taxonomy technology.cryptographic.jwt -o json-schema

Aliases

json_web_token

Type Registry