WT* is JWT?
summary
Clear definition: JWT is a format with multiple implementations—most commonly JWS vs JWE—and JWS is a plain JSON payload plus a cryptographic signature. Concrete components covered: header/payload/signature, jwks key rotation using kid and jku, and delegating verification to load balancers or CDNs (Akamai API Gateway example). Practical warnings: never store sensitive data inside tokens, decode is not verify so always check signature, and don’t trust jku hosts unless they’re explicitly whitelisted.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:27JSON Web Tokens
- 2:50Man-in-the-middle attacks
- 4:35Asymmetric cipher basics
- 7:25Signing messages
- 8:52JWT basics
- 11:20JSON Web Signature vs JWT
- 13:10JWT claims
- 14:55Pre-JWT auth issues
- 16:39JWT for auth
- 17:22JWT in Spring Boot
- 18:25Offloading JWT validation
- 19:48JWT in OAuth 2.0
- 20:53JWKS for key management
- 23:02Compromised key handling
- 23:46JWT pitfalls
- 25:10JKU security risks
- 26:15Conclusion
