JWT令牌

JWT令牌

• 透明令牌：uuid等形式，令牌没有额外信息
• 自包含令牌：自解释，包含：
  • claims：客户元数据和申明
  • issuer：颁发者
  • audience：期望接收人
  • scope：范围

JWT令牌示例

分三部分，用 “.” 间隔

HEADER:ALGORITHM & TOKEN TYPE
{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD:DATA
{
  "sub": "1234567890",
  "name": "John dddddddddddDoe",
  "iat": 151221321321321313123213123
}

VERIFY SIGNATURE
HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  password
)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gZGRkZGRkZGRkZGREb2UiLCJpYXQiOjEuNTEyMjEzMjEzMjEzMjEzMWUrMjZ9.bHpy1dRFlGxq0OpplB3hP_Nr9maQHMTVyvgKR0CPjgE