JSON Web Token

JSON Web Token: Compact, signable token for transmitting identity and authorization information. The term relates to the security of applications, interfacesInterfaceA defined boundary through which systems, components, or users exchange data and commands., or development processesDevelopment ProcessThe organized workflow used to design, implement, test, release, and maintain software.. Relevant measures range from secure designSecure DesignDesigning systems so security requirements and trust boundaries are addressed before implementation. and testing to runtime protection and rapid remediationRemediationThe correction or mitigation of a confirmed security weakness, defect, or misconfiguration..

How it works and where it fits

The security of JSON Web Token comes from the combination of algorithm, parameters, keys, protocol, and implementation. A mathematically strong primitive can be defeated by an unsuitable mode, weak randomness, incorrect certificate validation, or exposed keys. The intended objective must therefore be explicit: confidentiality, integrity, authenticity, or non-repudiation.

Practical security relevance

In practice, key and certificate management is often more decisive than algorithm choice alone. Generation, storage, distribution, rotation, revocation, and destruction require defined controls and monitoring. Compatible parameters, maintained libraries, migration capability, and a response process for compromised keys are also necessary; proprietary cryptographic constructions should be avoided.

Related concepts

• OAuth 2.0OAuth 2.0Standard for delegated authorization without sharing the user's password.: Standard for delegated authorization without sharing the user’s password.
• OpenID ConnectOpenID ConnectProtocol for federated login and the transmission of verified identity information.: Protocol for federated login and the transmission of verified identity information.
• AuthorizationAuthorizationDecision regarding which actions an authenticated identity is permitted to perform.: Decision regarding which actions an authenticated identity is permitted to perform.
• JSON Web EncryptionJSON Web EncryptionStandard format for encrypted and integrity-protected JSON-based messages.: Standard format for encrypted and integrity-protected JSON-based messages.