{"id":1676,"date":"2022-07-13T01:08:45","date_gmt":"2022-07-12T19:38:45","guid":{"rendered":"https:\/\/ontoborn.com\/blog\/?p=1676"},"modified":"2022-07-13T01:10:28","modified_gmt":"2022-07-12T19:40:28","slug":"what-are-jwt-tokens-and-their-different-forms-jws-and-jwe","status":"publish","type":"post","link":"https:\/\/ontoborn.com\/blog\/what-are-jwt-tokens-and-their-different-forms-jws-and-jwe\/","title":{"rendered":"What are JWT tokens and their different forms\u200a\u2014\u200a JWS and JWE?"},"content":{"rendered":"\n
\"\"<\/a><\/figure>\n\n\n\n

Hello everyone. In this article, we will be seeing everything you need to know about JWT, JWS, and JWE.<\/p>\n\n\n\n

<\/a>What is JWT?<\/strong><\/h1>\n\n\n\n

JSON web token (JWT) is an open standard (RFC 7519) that defines how to contain the information in a JSON format and communicate with different parties. There are many types of tokens used and JWT is just one of them and the most popular one<\/p>\n\n\n\n

JWT is smaller in size and very compact that contains all the information a server needs to verify a client. It is very faster and secure and hence widely adopted by many applications and also the frameworks like OAuth and OIDC(Open ID Connect).There are two different approaches to Managing Sessions in an applications<\/p>\n\n\n\n

  1. Session or Cookies based approach<\/strong><\/li><\/ol>\n\n\n\n
    \"\"<\/a><\/figure>\n\n\n\n

    In this approach, session Ids are stored in a session DB and the server always needs to verify the session Id hence it is stateful which takes a lot of overhead on the server if there are too many sessions being used in the application<\/em><\/p>\n\n\n\n

    2. Token(JSON Web Tokens) based approach<\/strong><\/p>\n\n\n\n

    \"\"<\/a><\/figure>\n\n\n\n

    In this approach, the server authenticates the client and generates the JWT token, and sends it to the client. Then the client sends the JWT token in the Authorization header on every request and the server does not maintain any state hence it is stateless and less overhead. JWT tokens are called Bearer tokens because all the information about the Bearer(User) is self-contained inside the token<\/p>\n\n\n\n

    <\/a>Where can a JWT be used?<\/strong><\/h1>\n\n\n\n

    JWTs have a lot of use cases and some of them are<\/p>\n\n\n\n