JSON Web Token
A JSON Web Token, or JWT, is a compact format for sending claims between parties with JWS or JWE protection. JWT is only a format, not a permission system.
Another example
An API gets a signed access JWT and allows only named algorithms. It finds a trusted issuer key. Then it checks `iss`, `aud`, `exp`, `nbf`, `scope`, and token type. It rejects `alg:none` and tokens made for another service. It leaves out personal data because a normal signed JWT is readable, not encrypted.
Main parts
- 01Protected header
- 02Claims set
- 03Signature or encryption result
Use it when
Use JWT when systems need a small, self-contained set of protected claims. They must strictly check its contents and expiry.
Do not use it when
Do not put secrets in a signed JWT or accept any algorithm or key. Avoid long-lived tokens without revocation, and use a simpler opaque session when it fits.
Name used in code
JOSE compact serialization + pinned alg/key + iss/aud/time/type validation Before you ship
Check contracts and invariants, authorization, and input limits. Test retries, one-time effects, timeouts, and partial failures. Verify data integrity, compatibility, monitoring, recovery, and rollback.
Outcome: Design or review JSON Web Token for this system while keeping data correct, secure, and easy to operate. User context: An API gets a signed access JWT and allows only named algorithms. It finds a trusted issuer key. Then it checks `iss`, `aud`, `exp`, `nbf`, `scope`, and token type. It rejects `alg:none` and tokens made for another service. It leaves out personal data because a normal signed JWT is readable, not encrypted. Technical concept or control: JSON Web Token. Why it fits: Use JWT when systems need a small, self-contained set of protected claims. They must strictly check its contents and expiry. Do not use it when: Do not put secrets in a signed JWT or accept any algorithm or key. Avoid long-lived tokens without revocation, and use a simpler opaque session when it fits. Engineering requirements: Define inputs, outputs, contracts, and rules that must always hold. Set authorization and input checks. Define failures, timeouts, retries, one-time effects, data moves, and compatibility limits. Operations: Add useful signals and logs that hide sensitive data. Set capacity limits and write an operator guide. Test recovery and rollback. Acceptance criteria: Contract and failure-path tests pass. Data and authorization rules still hold during retries and partial failures. Check performance limits, monitoring, recovery, and rollback. Evidence and limits (evidence boundary): The standard covers only the listed scope. It does not choose the visual style, product decision, or Vibulary example. Unknowns to confirm: Where the code runs, data stores, traffic shape, consistency needs, and the security boundary. Also confirm the compatibility period, service goals, and rollback limits.
Check this request
Review the current use of JSON Web Token. Definition: A JSON Web Token, or JWT, is a compact format for sending claims between parties with JWS or JWE protection. JWT is only a format, not a permission system. Release checks: Check contracts and invariants, authorization, and input limits. Test retries, one-time effects, timeouts, and partial failures. Verify data integrity, compatibility, monitoring, recovery, and rollback. Before changing code, report the evidence you found, gaps, severity, and the smallest safe fix.