← Back to the reading view
Slides · 8 slides
JSON Web Tokens & API authentication
The same module told visually, ready to present. Speaker notes carry the full explanation.
Protocols
JSON Web Tokens & API auth
A signed claim in every request header, and a few mistakes that keep recurring
JSON Web Tokens & API authentication · Classical Crypto Today1 / 8
Decoded
Base64url is not encryption
Anyone can read the claims; never put secrets in a JWT payload
JSON Web Tokens & API authentication · Classical Crypto Today2 / 8
Guarantees
What the signature proves
JSON Web Tokens & API authentication · Classical Crypto Today3 / 8
Where state lives
JWT versus opaque session token
JSON Web Tokens & API authentication · Classical Crypto Today4 / 8
Revocation
Short access token, long refresh token
JSON Web Tokens & API authentication · Classical Crypto Today5 / 8
Key rotation
kid and JWKS
Rotate: publish the new key, sign with it, drop the old one after the last token expires
JSON Web Tokens & API authentication · Classical Crypto Today6 / 8
Advanced · alg: none
An unsigned token, trusted
JSON Web Tokens & API authentication · Classical Crypto Today7 / 8
Advanced · algorithm confusion
A public key used as an HMAC secret
Fix: pin the expected algorithm per key; never read it from the token
JSON Web Tokens & API authentication · Classical Crypto Today8 / 8
1 / 8
Keys: ← → move, F full screen, G all slides, N notes