JWT Authentication Explained

[@MattEland]

This is also available in written form on my blog: newdevsguide.com/2022/11/12/json-web-tokens-simplified/

[@MatthewMiller-hk7kw]

Single handedly the best explanation I've ever gotten over this!

[@MattEland]

Thanks! It's just a very well-suited metaphor.

[@ChinchillaDave]

JWT equals hotel key card. Brilliant, thank you! Both require upfront verification once but permit use of the token in subsequent interactions as a replacement, for a certain time period and subject to further rules and limitations. So good!

[@omotosoiyanu1767]

I’ve have been watching videos and reading articles on JWT for some time now and I still find myself going back to another article to understand even the basics but after watching this I don’t think I will ever go back to watching a video on just the basic understanding of JWT again … Thank you very much

[@muratkaradas1483]

I really loved the example you used in this video. Thank you for explaining it in such a clear and relatable way 👍

[@MattEland]

Thanks for the kind words!

[@yx1566]

thank you so much for this explantion! I searched JWT today since I keep forgeting how JWT works, after watching your video i think i will never forget it

[@MattEland]

Glad to hear it!

[@allhailalona]

Thank you for this remarkable explanation! I'm glad to be the the 875th liker and a new subscriber to your channel!

[@LaveshNK]

Amazing explanation and analogy used!! Thank you for the video

[@aashishpaudel6822]

loved the metaphor, best one I heard so far in this topic

[@TheJasonTorres]

This breakdown was my lightbulb moment thank you

[@packtrouble6270]

I would say this is probably the best explanation I have seen.

[@MattEland]

Thank you! I believe it came about from traveling to speak at conferences around the same time I taught my students JWT authentication.

[@jpkeys6000]

This metaphor is great. Thank you Matt!

[@ADHJkvsNgsMBbTQe]

Cyber security tip: don’t show your real identity card or badge online. Respectfully suggested.

[@overrevvv]

Thank you so much for being on youtube and this video.

[@estherinyang4779]

Thank you so much for this explanation. Really easy to understand.

[@CodeWithJude]

Great analogy to teach the concept of JWT authentication!

[@paulmittelstaedt6970]

this vieo is just perfect

[@MattEland]

Glad it helped! Enjoy the journey

[@DanielTakov]

Perfectly explained thank you!

[@ianpropst-campbell6028]

This was actually a really helpful analogy. thank you for sharing!

[@nanakwasi7690]

Glad you could help me understand JWT better. Thanks

[@1337ArMaAa]

Perfectly explained, thank you so much!

[@PP-ow1xy]

thank you so much for this very smart analogy Matt! you certainly made a difference to my understanding and you got yourself (at least) one more subscriber (as I am going to share this video with my bootcamp's cohort).

[@MattEland]

That's fantastic! I built this in-part for my bootcamp students as well, so happy to help others.

[@PP-ow1xy]

@@MattEland it's nice you want to pass knowledge whichever way you can. Kudos Mat! Best Regards Panagiotis (linkedin)

[@adithyar3160]

luvd the explanation

[@walkwithusuf82]

Brilliant explanation

[@schwartztutoring]

Great analogy!

[@tanveeransari989]

Awesome analogy 🎉

[@mikes.2336]

Thank you! The analogies really helped!

[@123pencilboy]

Thank you so much, I understand the concept now!

[@TamaraPWork]

amazing explanation, thank you!

[@CorneliusKipkorir-c4e]

This is really a very interesting content

[@John-eq5cd]

A good analogy, thanks. From what I understand a valid jwt sent by the user's browser allows access to various restricted web pages on an app. Therefore, if the jwt is stolen somehow then the thief will also have access. How likely is this and will possession allow full access without any other checks on the user?

[@MattEland]

JWTs are intended to be private and secure. In the case that a JWT is somehow compromised, it is still valid until its expiry date, unless the server does some additional checks beyond validating that a JWT was signed by itself. In an absolute emergency, the server's signing key could be changed, but this would effectively invalidate ALL issued JWTs.

[@AlexFirsikoff]

Great explanation, thanks a lot!

[@MattEland]

Happy to help! This explanation helps a lot of my students and I'm happy to share.

[@reeseovine]

i've understood this pretty well for the most part, but the part that confuses me is what if a JWT gets "lost" like a keycard very easily could? anyone who picks it up could access otherwise restricted areas in theory. surely there must be something preventing something this from happening with JWTs?

[@MattEland]

Yes, if a JWT is intercepted it can be used before its expiry. This is why we have an expiration time and date. We rely primarily on transport layer security encrypting the headers to secure our JWTs. Keep in mind that even if you have a valid JWT that JWT will likely only be useful for interacting with some resources so you need to have the JWT and know which URLs it should go to - similar to finding a key card in the lobby of a hotel grants you access to a room, but you're not sure which one. Some systems also offer ways of invalidating JWTs known to be lost or compromised, such as when employees are let go, but this is not required.

[@augustinekirumba4304]

Thanks for the examples, helped understand better

[@MattEland]

Glad it helped!

[@iraisvalenzuela6147]

Great explanation! Thank you!

[@MattEland]

Glad it was helpful!

[@BruceChan-du4uf]

very good explanation

[@PeterTurnerBexley12]

Thank you - that was invaluable !

[@MattEland]

No worries. JWTs can be very confusing!

[@hlpires101]

hey this explanation was insane thx

[@MrMarcoAlvarado]

I think what is hard to understand, is that you do not need the secret key for the server side validation of the token, if I'm right. Otherwise there would be no difference to using session.

[@MattEland]

Correct. The only one who has the secret key is the server who signs the JWT.

[@mufizshaikh8439]

amazing example!

[@grampro8572]

Very nice explanation

[@MattEland]

Thank you very much! I frequently find myself sharing this one with students curious about careers in data, so I'm glad it helped!

[@poriaasadipour]

Thank you very much sir!

[@harithabandara3212]

Thank you❤

[@neameh.karineh]

Thanks a lot. It was helpful for me.

[@MattEland]

Fantastic! Sometimes the right metaphor can do wonders.

[@onedev7316]

thanks for the explanation. can you please do a video on User Impersonation using Identity/JWT with an example in .NET. I am unable to understand how this going to work when token is generated already. Sorry if question is dumb.

[@MattEland]

It's not a dumb question. It's not fully in my typical set of content I produce, but I'll add a backlog item for that. Can't predict when or if I'll get to it, though. You'd likely be best searching for creators who specialize in asp.net configuration and security.

[@Netz0]

The answer to your question is that JWT's tokens are for authorization, not for authentication, different things. It just tells you when a request is authorized on a server or application, but not who or what is doing the request. You need to combine it with another authentication form that checks the user to avoid impersonation.

[@emma_promise_smartnbc4331]

Thanks

[@more-uv4nl]

thanks alot Sir !

[@RositaBrockington-v9i]

Keegan Plain

[@LeonAbraham-m8w]

Labadie Crest

[@ZangwillKing-x6m]

Hirthe Brooks

[@ghjhgj-p2i]

Olson Expressway

[@maziatr]

JWT is used for Authorisation, not Authentication

[@MattEland]

Very good! Keep going on your learning journey, you're making great progress!

[@maziatr]

@@MattEland You too. Perhaps one day you will find out the difference between the two.

[@MattEland]

@maziatr I don't understand, either I knew already or you told me just now for the first time. In either of those scenarios, I'd know, right? Also, you seem like a hostile person and I wish you well, but I'll leave you on your journey from here.

[@GerryRodrguez-v3h]

Randal Avenue

[@марияагафоник]

Allen Larry Garcia Linda Taylor Joseph

[@HicksHoover-y2u]

Quigley Landing

[@EmersonMorton-e3b]

Elena Square

[@SonmerfieldWendell-e4q]

Garcia Daniel Smith Matthew Allen Paul

[@VioletRuth-t4r]

Claude Plaza

[@ClemensVenus-j3j]

Guido Shoals

[@JerryVincent-o5e]

Sadie Track

[@KatrineParker-k8f]

Heaney Station

[@MarciaMezza-y7y]

Rogahn Estate

[@MarySmith-j3w]

Heller Canyon

[@WaltonValentine-i4s]

Walter Roads

[@ConnorMerle-p6d]

Bode Station

[@GaryJackson-q7w]

Garcia Sharon Williams Melissa Martin Cynthia

[@MaggieNicole-e4g]

Beier Springs

[@AntoinetteSusie-r3m]

Young Kimberly Anderson Mark Brown Mark

[@MariaThompson-d7y]

Hall Maria Lopez Donald Robinson John

[@DollyCleveland-l1f]

Martinez Barbara Williams Jason Moore Kenneth

[@Iron_spider99]

Pronouncing JWT as one word instead of saying their individual letters should be a war crime.

[@MattEland]

You should check the JWT specification. It describes how to pronounce it.

[@Iron_spider99]

@@MattEland blasphemy

[@RogerMartha-e6s]

Coty Club

[@FredMyrna-x2f]

Robinson James Allen Frank Clark Betty

[@MatthewCarpino-o5z]

Klocko Mall

[@ThackerayAudrey-j5g]

Taylor Nancy Brown Paul Thompson Mark