Authenticating your single page apps using JSON Web Tokens
summary
Explains that JSON Web Tokens are three base64 parts—header, payload (claims) and signature—and that APIs can verify expiry and tampering without a database lookup. Demonstrates a SPA getting an ID token and an access token from Google and using the access token as a Bearer header to fetch protected cat images successfully. Covers OAuth2/OpenID Connect, JWKS for public keys, warns against persistent storage in browsers, highlights revocation difficulty and recommends auth code with PKCE and refresh token rotation.
AI-written summary · about
chapters (12)
- 0:00Introduction to JWT
- 2:27Traditional authentication
- 3:51Modern app architecture
- 6:35Understanding tokens
- 8:04JWT structure and security
- 13:04Keys and verification
- 14:48JWT as a digital passport
- 16:08Demo and API usage
- 19:12JWT pros and cons
- 21:25OAuth and OpenID Connect
- 26:56Summary and conclusions
- 29:25Q&A session
related talks
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
40mKnock knock, who’s there? Authenticating your single page apps using JSON Web Tokens
22mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
26mSecuring Single Page Applications with Token Based Authentication
28mA Token Walks Into a SPA...