# JSON Web Token

* JWT is a format
* It can be used for many purposes
  * ID Tokens are **always** JWTs
  * Access tokens **can** be JWTs
  * Refresh Tokens are **"never"** JWTs
* Most often signed (JWS)
* Can be encrypted (JWE)

<figure><img src="https://519089207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2A0dg9Wy89z8CRkQMup2%2Fuploads%2FlWpkfMmHoRLhNmjMGNce%2F2024-08-09_16-08.png?alt=media&#x26;token=4dc4d12d-75b3-4ebf-8626-792bcf90023d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://519089207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2A0dg9Wy89z8CRkQMup2%2Fuploads%2FNRjhryDiLfuQkYi5ca8N%2F2024-08-09_16-09.png?alt=media&#x26;token=a5f2a1f2-8c3c-4938-a9a1-91233409588c" alt=""><figcaption></figcaption></figure>

## Signed - JWS

* Proves who issued the token
* The prominent way for JWTs
* Asymmetric signatures
* Always whitelist algorithms allowed
* Don't rely on signature verify contents as well
  * Audience
  * Issuer
  * Expiration

## Encrypted - JWE

* Keeps data confidential
* Used in OpenID Connect
* ID Tokens
* User info responses
* Not practical for access tokens
* Opaque tokens are preferred to keep confidentiality

## JWTs and Protocols

A JWT **is not a protocol**.

They can be used in different ways depending on protocols

They should **not be used** against the **protocol's intention**.

## Example

* Access tokens are for the API
* They are issued to the client
* The client **should bot decode** the access token

<figure><img src="https://519089207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2A0dg9Wy89z8CRkQMup2%2Fuploads%2F4a4hrHjoLK1ntq0vBK1I%2F2024-08-09_17-20.png?alt=media&#x26;token=1e82b4a5-d9c4-4910-8127-2b72c34e236d" alt=""><figcaption></figcaption></figure>
