JSON Web Tokens (JWT) Security Best Practices: Header, Payload & Verification

What is a JSON Web Token (JWT)?

A JSON Web Token (RFC 7519) is a compact, URL-safe means of representing claims to be transferred between two parties. JWTs are widely used for stateless session management, single sign-on (SSO), and API authorization.

The 3 Components of a JWT

A standard JWT string consists of three Base64URL-encoded parts separated by periods (.):

header.payload.signature

1. Header

Specifies the token type (JWT) and the cryptographic signing algorithm (e.g., HS256, RS256, or ES256).

2. Payload (Claims)

Contains statements about the entity (typically the user) and additional metadata:

• sub (Subject): The unique user or principal identifier.
• iat (Issued At): Unix timestamp indicating when the token was generated.
• exp (Expiration Time): Unix timestamp defining when the token becomes invalid.
• iss (Issuer): The authoritative identity provider that signed the token.

3. Signature

Calculated by hashing the encoded header and payload with a secret or private key:

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

Critical JWT Security Pitfalls

1. Never Store Sensitive Secrets in Payloads: Payloads are merely Base64URL encoded, not encrypted. Anyone can decode and view claims using our JWT Token Inspector.
2. Always Enforce Expiration (exp): Tokens without an expiration claim remain valid indefinitely if intercepted.
3. Block the "alg": "none" Exploit: Ensure your authentication middleware rejects unsigned tokens.