JWT令牌
- 透明令牌:uuid等形式,令牌没有额外信息
- 自包含令牌:自解释,包含:
- claims:客户元数据和申明
- issuer:颁发者
- audience:期望接收人
- scope:范围
JWT令牌示例
分三部分,用 “.” 间隔
HEADER:ALGORITHM & TOKEN TYPE
{
"alg": "HS256",
"typ": "JWT"
}
PAYLOAD:DATA
{
"sub": "1234567890",
"name": "John dddddddddddDoe",
"iat": 151221321321321313123213123
}
VERIFY SIGNATURE
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
password
)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gZGRkZGRkZGRkZGREb2UiLCJpYXQiOjEuNTEyMjEzMjEzMjEzMjEzMWUrMjZ9.bHpy1dRFlGxq0OpplB3hP_Nr9maQHMTVyvgKR0CPjgE