Introduction to JWT (JSON Web Token) - Securing apps & services

-What is JWT (JSON Web Token)
-What is the structure of JWT
-What are Header, Payload (claims) and Signature of JWT
-How is JWT used in applications
-How to create, tamper and verify JWT (understanding JWT, with no code)

[@shaneperera6635]

After hours of reading articles, this finally helped me to understand how everything fits together. Great explanation.

[@Techcbt-online]

Thank you..

[@factionzer0]

Wow...this video was phenomenal. I was having some trouble wrapping my head around the flow of JWT's and this video cleared it up completely!

[@VinodKumarBM]

Have seen many videos on JWT. but now I got good understanding on JWT. Thank you.

[@seriousguy2007]

I have never saw something explained like this! Great job sir! I am your fan already.

[@motamendez]

Give a cookie to this man! Nice video I love you my men

[@Techcbt-online]

Ha ha..Thank you

[@jasmeetsingh301]

Cookies are what he wants us to avoid.

[@ranjan5ua]

Funny Jasmeete...Very funny..Excellent sense of humor.

[@dirk1499]

You saw the chance and took it :)

[@dnyaneshmisal6786]

This video gives very clear understanding of JWT. Thank you sir for making such a wonderful video !!

[@s001dxp]

Very clear and thorough explanation of the topic. Thanks for taking the time to teach this!

[@Techcbt-online]

Thanks Darryl

[@bobbysugianto5744]

PERFECT TUTORIAL Liked and subscribed! Keep up the good work Sir

[@jasmeetsingh301]

Thanks! Very nice explanation. You saved me a lots of time.

[@Techcbt-online]

Thank you

[@onwuzorvictor3937]

Best explanation of JWT concept so far

[@srinicissp6076]

Very well made . Crisp and sharp.

[@rajparekh08]

very well explained. Thank you for taking time out and making this video .

[@Techcbt-online]

Thank you

[@kalyanhr]

Very informative and well presented!!

[@hoaktechology670]

Very nicely explained. Clear, simple understandable format. Thank you very much!

[@Techcbt-online]

Thank you.

[@pkjacobpullolickal7048]

Excellent tutorial. Thank You!!

[@adeelawan9259]

No doubt, it is a great tutorial to learn JWT and flow of JWT based APIs. Thank you very much.

[@Techcbt-online]

Thanks Adeel

[@wwhill8033]

Fantastic explanation, thanks very much.

[@dravidianlabs5007]

Wonderful tutorial, beautifully structured and basics are covered in detail.

[@Techcbt-online]

Thank you

[@kingramses8361]

Awesome tutorial. Thanks!

[@sajidrazarizvi9628]

Best video on JWT, well explained !! Thank you .

[@Techcbt-online]

thank you

[@TVP_Akshay]

Awesome presentation. Thankyou

[@samme4life]

JWT well explained. Thank you for this video.

[@seriousguy2007]

Wonderful! I have no sofatwre development background but you made it so easy.

[@Bibhaw]

very well explained. Thank You.

[@TellaTrix]

A way of teaching tech article JWT fabulous. The video is making sense on each sentence and properly understood. Keep updating us. i am awaiting for practical session with C#.

[@Techcbt-online]

Thank you.

[@vedangkavathiya8652]

Thank you sooooooooooooooooooooooooo much. You earned one more subscriber. You made my concept crystal clear 🙂

[@MadanNeelapu]

very nice. but very slow. but it helped me understand JWT. Thank you so much.

[@aArcziMetin2]

Very very good explanation! After all those months :D I get it now! Thanks!

[@Techcbt-online]

Thank you

[@mainulhasan35]

Excellently explained!

[@prabhu3903]

That was the best explanation in 30 mins :)

[@Techcbt-online]

Thank you

[@SushilKumarBhaskar]

100000+ Incremental Likes, Excellent Explained... ee+

[@trevorward5709]

Great video, very informative. Thanks very much!

[@Techcbt-online]

+Trevor Ward Thanks for the compliment.

[@kssaggu77]

Thanks a lot, very informative

[@manishavyas1846]

Thank you. Its very informative video.

[@Techcbt-online]

Thank you..

[@kaysi768]

really well explained, so good thank you

[@Techcbt-online]

+ComicBookGuy Henderson Thank you

[@pushpasekharmatli6237]

Nice explanation, Thank you.

[@Techcbt-online]

Thank you

[@naumanahmed19]

Thanks for sharing your knowledge.

[@Techcbt-online]

Thank you

[@CountOfPersia]

This is the best video on the topic. Excellent work ;)

[@Techcbt-online]

Thank you

[@tazihosniomar]

thank you sir it's really helps me a lot

[@testinghybris237]

Nice and simple explanation. ;)

[@teshomealemayehu5248]

What you are doing is really cool. Thanks

[@Techcbt-online]

+Teshome Alemayehu Thank you

[@anishravindran7545]

Excellent man.. Great video ..

[@yassinebenhadi4883]

I appreciate this, thanks!

[@christianaguilar7107]

Excelent explanation.

[@kempannamudalagi6906]

Awesome, very infromative video on JWT

[@Techcbt-online]

+Kempanna Mudalagi Thank you

[@codmobile9727]

Nice and simple... great work, mate...

[@Techcbt-online]

Thank you

[@dheerajvv1996]

Awesome content!

[@MovementVibes]

Best JWT tutorial on youtube. However I wonder how can a client verify that the data is not tampered? As client don't know the hashing key.

[@connchri]

The client doesn't use the data in the JWT - it's used server side and it's there that it needs to be checked against tampering. If you have a non-traditional web app, and have a client side app that uses JWT, then you'll need to find a secure way to share the secret so the client can verify the signature. The issue then being, if the secret becomes compromised, then you have lost all security.

[@ericlin1824]

You can use a private key to sign the signature in the server side. Public key to verify the signature on the client side.

[@jean-marievidalenc3957]

nice presentation, thanks

[@timothyross4766]

Nice vid! Really makes sense.

[@Techcbt-online]

Thanks Ross.

[@amarasrilekha8091]

very clear explanation

[@padole7385]

Very nicely explained !!

[@Techcbt-online]

Thank you

[@saifatali7885]

Thanks! You saved me a lots of time.

[@Techcbt-online]

Thank you

[@AistisJokubauskas]

Great video, thanks mate!

[@Techcbt-online]

+Aistis Jokubauskas Thank you

[@HemanthKumar-od2ej]

best video on JWT !!!! :)

[@deepcoolclear]

Excellent overview. One question is how is the secret key passed to the server in your example to verify the hash? Also will be good to mention you don’t need to do JWT level encryption yourself you can let network handle it by using TLS. Also helps against replay. If you can advise if JWT should be stored in local storage or as a cookie will be beneficial as well in terms of XSS or CSRF.

[@clivesargeant394]

great tutorial. thanks!

[@Techcbt-online]

thank you

[@JohnnyHorvi]

good job, very well explained.

[@Techcbt-online]

+Johnny Horvi Thank you

[@miguel.arcanjo]

Obrigado por compartilhar o conhecimento de forma muito didática!

[@segmentationfaulter]

great introduction to JWT.

[@Techcbt-online]

+Muhammad Saqib Thank you

[@mnkartik]

excellent explanation.

[@Techcbt-online]

Thank you

[@vivekmishra5876]

Great tutorial

[@ArturMusin]

Nothing but thank you !

[@kamesh7818]

very infromative video on JWT

[@Techcbt-online]

Thank you

[@psinghiitr]

excellent presentation.

[@Techcbt-online]

Thank you

[@soonclass4269]

Thank you!!!

[@wylieclint]

very useful.. thank you.

[@Techcbt-online]

Thank you

[@ujithaperera2145]

thanks for your effort !

[@Techcbt-online]

Thank you

[@hardikoladia7630]

awesome, It would be great if u create angular 2/4 tutorials and a video how to use JWT with Angular 2/4

[@AlexB-tt5di]

Very well explained

[@Techcbt-online]

Thanks Alex

[@tykilast2250]

thanks bro..................

[@tamersaleh6666]

The best of the best!

[@Techcbt-online]

Thank you

[@MrKirankoyelada]

Nice Video and Nice explain

[@Techcbt-online]

Thanks Kiran

[@alexeyku8926]

Thanks! Good video

[@Techcbt-online]

Thank you

[@tysonliu2833]

very helpful!! just one question, what if someone steels the JWT and pretends to be the issuer and everything

[@IthaliiJackson]

cool stuff Big up

[@helloworld8201]

Great video

[@Techcbt-online]

Thank you

[@stevehyuga9216]

It is very long, but very good tutorial.

[@Techcbt-online]

Thanks for the comment Brian. There have been some repetitions in the video (from the feedback received from readers). We tried to reduce repetitions drastically in recent videos. But, still unable to manage the duration of videos :(

[@sanjaymahadevan4367]

I am trying to use jwt strategy two times with different collection for user and admin ,so that route can be protected accordingly but as soon as i use it for admin ,its showing authentication error for user..and any data of user is not visible at client side...but is stored in local memory

[@robertkaufman1406]

Around 19:00, you say that the client can verify the token, but I don't think that is possible, since only the server will have the secret key which is necessary to do this. Am I missing something?

[@Techcbt-online]

It is possible using private key and public keys as part of implementation

[@atif7865]

That was a fundamental part of this and you missed it! Even your reply doesnt explain it. Because of this I had to give a thumbs down because no developer will ever use JWT without understanding this part.

[@denniszhang2147]

Thanks!

[@umar8539]

Great Explaination. I have a simple question ? what if JWT token would be stolen or hijacked ?

[@dhawalbhanushali4967]

During subsequent requests does server need to verify if its coming from the right host/client?

[@sanjibdutta9270]

very nice video

[@Techcbt-online]

Thank you.

[@sredar5667]

nice one dude :)

[@ZuberVhora]

Sir I have one Question that in JWT, we have to store the encoded data in the database table also.? like if the username is "abc" then we have to first encode it? before storing it into the database? Thanks in advance.

[@pinkcyan]

Good!

[@humble_integrity]

so what if we do want to encrypt something, what would you suggest for this? jwe?

[@jonu.1504]

You may put related video(to verify jwt) link in description.

[@Techcbt-online]

Good one..will do

[@jitendradwivedi4892]

Tech CBT hk

[@yatashdeepsharma4232]

missing token errror

[@JetseDas]

If you store the token in localstorage, does it imply you set a very long expiration time for the token? In the tutorial I did, they set the expiration time to three hours. How would that work in a real world scenario? You would be logged out almost every time you come back right?

[@chaituvirtusa]

I have a question, how can the client verify if the jwt is tampered ( in step 4)? For verification it needs 'secret key' used by server, for generating signature.

[@nikosc]

excellent

[@Techcbt-online]

Thank you

[@vyacheslavzgordan6725]

Thank you for the video! I've got a question - what if someone not only modified the payload but the signature as well?

[@lukeyyyyy100]

It would be invalid since the token wouldn't match the token on the server.

[@shankardayal6928]

great.... what is difference between session and token?? kindly explain this with some examples

[@kiranpvn]

awesome

[@Techcbt-online]

Thank you

[@djkadakamc1889]

Nice. Miss only the "refresh" part and considerations regarding the problems revoking token (blacklist and other strategies)

[@jesus-love]

well in order to revoke you must store it somewhere in the backend (redis, mongoDB, levelDB) which defeats the stateless nature of JWTs. Instead you could increase the security some other way like the module below which authenticates tokens based on IP address. Check out the link for more information. www.npmjs.com/package/express-jwt-ip

[@meditationmethods9421]

Hi, When the credentials are passed to the server, what 'secret' will be used by the server to create a token? Will this be shared with the client ? Thanks.

[@abhishekp6080]

At Step 4, how can a client verify the JWT token if it is tampered or not?

[@sagarahuja5667]

I have stored some logged in user values in the token when the user edits it i want refresh the token is there any way ?

[@volivattam]

Hi, The video was very informative. I am looking forward to your upcoming videos on creating JWT using other technologies. I have one query regarding the verification of token in the consumer/client. You say it is optional and most of them do not do it. Is this a safe assumption to make. For financial and banking services I feel this might be required.

[@Techcbt-online]

+Sridhar Balasubramanian Not really. Not everyone does. To be really safe/secured, we should do it at client-side too

[@YAG-iw8vi]

How is that possible on the client?