You may read the “JOSE” keyword when searching the Internet for details on JSON web tokens. Well, you’re likely to find “JOSE” in references to the JWT specification and not in actionable tutorials. What is JOSE in combination with JWT? That’s a good question! JWT defines the token …

When starting out with JWT a shared secret is the simplest way to sign and verify tokens. While developing your application and progressing with the JWT usage, you’re arriving at JSON web keys and key sets. The previous tutorial shows how to use a JWKS API endpoint for authentication. …

JWT authentication uses a secret to sign or encrypt the tokens. Using an asymmetric algorithm based on a public/private key pair comes with some benefits. One benefit is that you can share the public key with anyone on the Internet. Of course, you must keep your private key safe …

When using JSON web tokens in your application, it’s required to have at least a secret key. Using a secret key comes with a simple setup. The downside here, you must share the secret between the parties interacting with the JWT. Going one step further, you could create and …

A JSON Web Key (JWK) is an important piece in the JWT universe because it represents a cryptographic key using a JSON data structure. Each JWK is represented by key-value pairs, like a typical JavaScript object but in JSON format. Additionally, the JSON Web Key Set is a JSON object …

All the previous tutorials in this series on JSON web tokens used a secret or private key in combination with a signing algorithm to create a token’s signature. But in contrast, the JWT specification also allows unsigned tokens. This supports use cases where a token’s content is secured …

JSON web tokens (JWT) are widely accepted on the Internet. You’ll find countless tutorials using JWT authentication. Most of them showing how to sign a JWT using an HMAC-based algorithm which is a quick way to get started. We both know that the copied code from a tutorial is …