# JSON Web Token

Key: `technology.cryptographic.jwt`

JSON Web Token (JWT) in either compact serialisation. A JWS is three base64url-encoded segments separated by dots, header.payload.signature; an unsecured JWT (RFC 7519 section 6) ends in a dot with an empty signature. A JWE (RFC 7516) is five segments (header, encrypted key, initialization vector, ciphertext and tag), where the encrypted key may be empty. Used for authentication and information exchange.

Page: <https://meridian.online/docs/finetype/types/technology/cryptographic/jwt>

Samples: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c`, `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk`, `eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.`

## Use it

Shell

```shell
finetype infer -i 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' --mode column
# → technology.cryptographic.jwt
```

DuckDB

```sql
SELECT ft_infer('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c');
-- → 'technology.cryptographic.jwt'
```

Cast template: {col} is your column

```sql
CAST({col} AS VARCHAR)
```

## Background

### Origin

The JSON Web Token is defined by RFC 7519, published in May 2015.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 was written by M. Jones, J. Bradley and N. Sakimura.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 is an Internet Standards Track document.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 describes a JWT as a compact, URL-safe means of representing claims to be transferred between two parties.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 suggests that JWT be pronounced the same as the English word "jot".[[1]](https://www.rfc-editor.org/rfc/rfc7519)

The JWS Compact Serialization is defined in RFC 7515, JSON Web Signature, as the base64url-encoded protected header, payload and signature joined by periods.[[2]](https://www.rfc-editor.org/rfc/rfc7515) RFC 7515 says the compact serialization is intended for space-constrained environments such as HTTP Authorization headers and URI query parameters.[[2]](https://www.rfc-editor.org/rfc/rfc7515) RFC 7515 defines base64url as Base64 encoding with the URL- and filename-safe character set, with all trailing '=' characters omitted.[[2]](https://www.rfc-editor.org/rfc/rfc7515)

RFC 7519 lists seven registered claim names: iss, sub, aud, exp, nbf, iat and jti.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 recommends that a JWT's "typ" header value be "JWT".[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 registers the "application/jwt" media type.[[1]](https://www.rfc-editor.org/rfc/rfc7519)

### Use

The OpenID Connect Core 1.0 specification says the ID Token is represented as a JSON Web Token (JWT).[[3]](https://openid.net/specs/openid-connect-core-1_0.html) RFC 9068 defines a profile for issuing OAuth 2.0 access tokens in JSON Web Token (JWT) format.[[4]](https://www.rfc-editor.org/rfc/rfc9068) jwt.io says clients typically send a JWT in the Authorization header using the Bearer schema.[[5]](https://jwt.io/introduction)

jwt.io advises against putting secret information in the payload or header of a JWT unless it is encrypted.[[5]](https://jwt.io/introduction) jwt.io states that tokens are credentials, so great care must be taken to prevent security issues.[[5]](https://jwt.io/introduction)

RFC 7519 defines an Unsecured JWT as a JWS using the "alg" header parameter value "none".[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 8725, JSON Web Token Best Current Practices, warns that an attacker can change the algorithm to "none".[[6]](https://www.rfc-editor.org/rfc/rfc8725) RFC 8725 says libraries must enable the caller to specify a supported set of algorithms.[[6]](https://www.rfc-editor.org/rfc/rfc8725)

## Sources

1. [RFC 7519: JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7519) — standard
2. [RFC 7515: JSON Web Signature (JWS)](https://www.rfc-editor.org/rfc/rfc7515) — standard
3. [OpenID Connect Core 1.0 incorporating errata set 2](https://openid.net/specs/openid-connect-core-1_0.html) — standard
4. [RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://www.rfc-editor.org/rfc/rfc9068) — standard
5. [JSON Web Token Introduction - jwt.io](https://jwt.io/introduction) — secondary source
6. [RFC 8725: JSON Web Token Best Current Practices](https://www.rfc-editor.org/rfc/rfc8725) — standard

## How it's detected

Each JWS segment, and the header, initialization vector and tag of a JWE, is at least 10 base64url chars to distinguish from other dot-separated formats. Header typically starts with "eyJ" (base64 for '{"'). Decompose reads the three JWS parts; the signature of an unsecured JWT is ''. A five-part JWE is not split (its parts are header, encrypted key, initialization vector, ciphertext and tag), so its payload and signature read ''. Discrimination counts a JWE or an unsecured JWT only when its header decodes to a JSON object with an "alg" member. An empty signature is accepted for any "alg", because logs often redact signatures, although RFC 7515 allows it only with "alg": "none".