JWT from the ground up
What is actually inside a JSON Web Token, how the signature makes it trustworthy, why you cannot take one back, and the mistakes that turn a token into a skeleton key.
CodexBash, , 7 min read
Almost every web API you will build or call hands out a JSON Web Token at some point. Most people learn to copy one into an Authorization header long before they learn what it is. This article goes the other way: take one apart, build one by hand, and then look at the decisions that make them safe or dangerous.
Sign in to read the rest
The whole 7 minute article is free with an account, along with every problem, lesson and tutorial. No card.