JWT
JWT (JSON Web Token)
A compact, URL-safe token format for securely transmitting claims between parties, widely used for authentication and authorization in web applications and APIs.
技術的詳細
A JWT consists of three base64url-encoded parts separated by dots: header (algorithm and token type), payload (claims like sub, exp, iat, and custom data), and signature (HMAC-SHA256 or RSA/ECDSA over header+payload). JWTs are signed but not encrypted by default, so payload data is readable by anyone. JWE (JSON Web Encryption) adds payload encryption. Common vulnerabilities include the 'none' algorithm attack, secret key brute-forcing for HMAC, and token replay. Best practices include short expiry times, refresh tokens, and audience/issuer validation.
例
```javascript
// JWT: web API example
const response = await fetch('/api/resource');
const data = await response.json();
console.log(data);
```