Understanding JSON web tokens
As written on the https://jwt.io website, a JWT (short for JSON Web Token) is an open, industry-standard RFC 7519 method for representing claims securely between two parties.
To keep it simple, we can think of JWTs as three distinct base64-encoded JSON chunks of data.
Let's take the following JWT as an example:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5MDhlYWZhNy03MWJkLTQyMDMtOGY3Ni1iNjA3MmNkMTFlODciLCJuYW1lIjoiSmFuZSBEb2UiLCJpYXQiOjE1MTYyMzkwMjJ9.HCl73CTg8960TvLP7i5mV2hKQlSJLaLAlmvHk38kL8o
If we pay enough attention, we can see three different chunks of data separated by periods.
The first part represents the JWT header. It contains two essential pieces of information: the token type and the algorithm used for signing it (we will talk more about that in just a second).
The second part is the payload. Here is where we put all the non-sensitive data that can help us identify our users. Never store data such as passwords and...
