JSON-WEB-TOKEN

token：令牌

官网

格式

part1.part2.part3

part1---Header

part1是一段base64编码.

The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.

它由两部分构成，token的类型，也就是JWT;以及加密payload的加密算法

例如

{
  "alg": "HS256",
  "typ": "JWT"
}

Then, this JSON is Base64Url encoded to form the first part of the JWT.

part2---Payload

part2也是一段base64编码

The second part of the token is the payload, which contains the claims. Claims are statements about an entity (typically, the user) and additional data. There are three types of claims: registered, public, and private claims.

• Registered claims（预先定好的字段）: These are a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims. Some of them are: iss (issuer), exp (expiration time), sub (subject), aud (audience), and others.

  Notice that the claim names are only three characters long as JWT is meant to be compact.

• Public claims: These can be defined at will by those using JWTs. But to avoid collisions they should be defined in the IANA JSON Web Token Registry or be defined as a URI that contains a collision resistant namespace.

• Private claims: These are the custom claims created to share information between parties that agree on using them and are neither registered or public claims.

它通常是用户实体的一些信息。上面的应用中的三个claims是为了处理字段冲突而定义的，具体可看链接

payload举例

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
}

The payload is then Base64Url encoded to form the second part of the JSON Web Token.

Do note that for signed tokens this information, though protected against tampering, is readable by anyone. Do not put secret information in the payload or header elements of a JWT unless it is encrypted.

最好不要在payload和header里放有关JWT的信息，除非已加密。（base64编码不是加密）

part3---Signature

它仍然是一段base64编码

这个部分是由part1.part2再经过加密算法和Base64编码得到的

加密算法是part1（header）里指定的

For example if you want to use the HMAC SHA256 algorithm, the signature will be created in the following way:

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

The signature is used to verify the message wasn't changed along the way, and, in the case of tokens signed with a private key, it can also verify that the sender of the JWT is who it says it is.

把part1.part2作为密文可以检测到传递的信息是否被篡改，通过私钥(secret)加密,，可以知道发jwt的是不是本人

把这三个part用“.”连起来就是完整的JWT了

使用

在http请求头里的Authorization字段里使用

Whenever the user wants to access a protected route or resource, the user agent should send the JWT, typically in the Authorization header using the Bearer schema. The content of the header should look like the following:

Authorization: Bearer <token>

JWT是用来认证的

比 Simple Web Tokens (SWT) and Security Assertion Markup Language Tokens (SAML).好用

它的使用不受Cross-Origin Resource Sharing限制