# JSON Web Token

Key: `technology.cryptographic.jwt`

JSON Web Token (JWT) consisting of three base64url-encoded segments separated by dots: header.payload.signature. Used for authentication and information exchange.

Page: <https://meridian.online/docs/projects/finetype/types/technology/cryptographic/jwt>

Samples: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c`, `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk`

## Background

### Origin

The JSON Web Token is defined by RFC 7519, published in May 2015.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 was written by M. Jones, J. Bradley and N. Sakimura.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 is an Internet Standards Track document.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 describes a JWT as a compact, URL-safe means of representing claims to be transferred between two parties.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 suggests that JWT be pronounced the same as the English word "jot".[[1]](https://www.rfc-editor.org/rfc/rfc7519)

The JWS Compact Serialization is defined in RFC 7515, JSON Web Signature, as the base64url-encoded protected header, payload and signature joined by periods.[[2]](https://www.rfc-editor.org/rfc/rfc7515) RFC 7515 says the compact serialization is intended for space-constrained environments such as HTTP Authorization headers and URI query parameters.[[2]](https://www.rfc-editor.org/rfc/rfc7515) RFC 7515 defines base64url as Base64 encoding with the URL- and filename-safe character set, with all trailing '=' characters omitted.[[2]](https://www.rfc-editor.org/rfc/rfc7515)

RFC 7519 lists seven registered claim names: iss, sub, aud, exp, nbf, iat and jti.[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 recommends that a JWT's "typ" header value be "JWT".[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 7519 registers the "application/jwt" media type.[[1]](https://www.rfc-editor.org/rfc/rfc7519)

### Use

The OpenID Connect Core 1.0 specification says the ID Token is represented as a JSON Web Token (JWT).[[3]](https://openid.net/specs/openid-connect-core-1_0.html) RFC 9068 defines a profile for issuing OAuth 2.0 access tokens in JSON Web Token (JWT) format.[[4]](https://www.rfc-editor.org/rfc/rfc9068) jwt.io says clients typically send a JWT in the Authorization header using the Bearer schema.[[5]](https://jwt.io/introduction)

jwt.io advises against putting secret information in the payload or header of a JWT unless it is encrypted.[[5]](https://jwt.io/introduction) jwt.io states that tokens are credentials, so great care must be taken to prevent security issues.[[5]](https://jwt.io/introduction)

RFC 7519 defines an Unsecured JWT as a JWS using the "alg" header parameter value "none".[[1]](https://www.rfc-editor.org/rfc/rfc7519) RFC 8725, JSON Web Token Best Current Practices, warns that an attacker can change the algorithm to "none".[[6]](https://www.rfc-editor.org/rfc/rfc8725) RFC 8725 says libraries must enable the caller to specify a supported set of algorithms.[[6]](https://www.rfc-editor.org/rfc/rfc8725)

## Sources

1. [RFC 7519: JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7519) — standard
2. [RFC 7515: JSON Web Signature (JWS)](https://www.rfc-editor.org/rfc/rfc7515) — standard
3. [OpenID Connect Core 1.0 incorporating errata set 2](https://openid.net/specs/openid-connect-core-1_0.html) — standard
4. [RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://www.rfc-editor.org/rfc/rfc9068) — standard
5. [JSON Web Token Introduction - jwt.io](https://jwt.io/introduction) — secondary source
6. [RFC 8725: JSON Web Token Best Current Practices](https://www.rfc-editor.org/rfc/rfc8725) — standard