Knock knock, who's there? Authenticating your single page apps using JSON Web Tokens
summary
Explains how JWTs are three parts — header, payload and signature — and that an expiry claim inside token lets servers reject expired tokens without a DB lookup; shows a dog/cat API demo that returns 401 for no token, rejects tampered tokens and expired tokens. Recommends saving access tokens in memory, using a refresh cookie for silent re-login, and switching from implicit flow to authorization code + PKCE. Demos JSONWebToken.io and webauthn via USB/fingerprint for passwordless login, and warns revocation still needs server state (blacklist).
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:15Overview
- 1:42Traditional Authentication
- 7:59The payload
- 8:21Reserved claims
- 8:58Public claims
- 10:10Private claims
- 11:25Example
- 13:44JSON Web Tokens
- 14:01Asymmetric algorithms
- 15:35Passport example
- 16:31Demo
- 19:47Base Authentication
- 23:24Token theft
- 25:37Implicit flow
- 27:36Solution
- 29:01Web Authentication API
- 34:56Summary
related talks
40mKnock knock, who’s there? Authenticating your single page apps using JSON Web Tokens
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
22mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
34mAuthenticating your single page apps using JSON Web Tokens
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
26mSecuring Single Page Applications with Token Based Authentication
32mTips and Tricks for JSON Web Tokens (JWTs)