本文介绍了JWT（JSON Web Token）身份验证中密钥的作用和生成方式。内容包括JWT的结构，如何解码其头部和声明部分，以及第三部分签名的生成过程，特别强调了签名使用的秘密密钥是通过HS256算法，需要发送方和接收方协商并线下传递。同时指出，秘密密钥可以是任意字节字符串，但必须确保安全地传递给接收方。
Recently I started working with JWT based authentication. After user login, a user token is generated which will look like
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ".
It consist of three parts each separated with a dot(.).First part is header which Base64 encoded. After decoding we will get something like
{
"alg": "HS256", //Algorithm used
"typ": "JWT"
}
Second part is claims and Base64 encoded. After decoding we will get something like
{
"sub": "1234567890",
"name": "John Doe",
"admin": true
}
Third part is signature and is generated with
HMACSHA256(
base64UrlEncode(heade
最低0.47元/天 解锁文章
1043
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
