Token-Based Auth and JWT

The BookNook phone app has no browser cookies to lean on, and BookNook's servers would rather not look up a session on every request. Token-based auth hands the client a credential it sends in a header, and a JWT is a token that carries its own proof, so the server can check it without asking a database.

The rule

A JWT is signed, not sealed: anyone can read it, only the issuer can forge it.

In token-based auth, the client signs in once and receives an access token. It sends the token on every request:

"Bearer" means whoever holds the token gets its access, like cash. So tokens must travel over HTTPS and be stored carefully.

A token can be an opaque random string the server looks up, or a JWT (JSON Web Token). A JWT has three Base64url parts joined by dots:

• Header: the signing algorithm, e.g. {"alg": "HS256", "typ": "JWT"}.
• Payload: the claims, e.g. {"sub": "7", "exp": 1790000000, "role": "member"}. sub is the subject (member 7), exp the expiry time.
• Signature: computed over header and payload with the server's secret key or private key.

To trust a JWT, the server verifies the signature, checks exp, and checks who issued it and who it is for (iss, aud). If a single character of the payload changes, the signature no longer matches.

What follows from "signed, not sealed":

• The payload is readable by anyone who has the token. Never put passwords or private data in it.
• The server needs no lookup, so any server with the key can verify it.
• A JWT cannot easily be revoked before exp. So access tokens are kept short-lived, often minutes, and paired with a longer-lived refresh token that the server does track and can cancel.
• The server must decide which algorithm it accepts, and must never accept a token whose header says "alg": "none".

The shortcut

Check any incoming JWT in a fixed order: signature → expiry → issuer and audience → then read the claims. Never trust a claim before the first three pass.

The trap is decoding the payload and trusting it without verifying the signature. Decoding proves nothing; anyone can write a payload.

Drills

Answer fast — trust the rule.

Remember

• A JWT is signed, not sealed: readable by anyone, forgeable only by the issuer.
• Shortcut: signature → expiry → issuer and audience → claims.
• Trap: trusting a decoded payload, storing secrets in it, and long-lived tokens that cannot be revoked.