JWT

Learn JWT authentication with jsonwebtoken.

What is JWT?

JWT (JSON Web Token) is a signed string that carries information safely between two parties. It is commonly used for authentication: the user logs in, the server returns a JWT, and the client sends it with subsequent requests.

A JWT has three parts: header, payload, and signature. The signature is produced with a secret; so the token cannot be tampered with. In Node.js you create and verify JWTs with the jsonwebtoken module.

jwt.sign and jwt.verify

jwt.sign(payload, secret) produces a JWT. payload is an object (e.g. { user: "Alex" }); secret is the signing key. The returned token is a string.

jwt.verify(token, secret) validates the token and returns the payload. It throws if the signature is wrong. You can pass an expiry as a third argument: jwt.sign(payload, secret, { expiresIn: "1h" }) makes the token valid for one hour.

Exercise Log the type of token

Import the jwt module. Produce a token with jwt.sign({ user: "Alex" }, "secret"). Log typeof token.

Show example solution

const jwt = require("jsonwebtoken");
const token = jwt.sign({ user: "Alex" }, "secret");
console.log(typeof token);

Test yourself

Complete the module name

const jwt = require("____")

Show answer

const jwt = require("jsonwebtoken")

Match each piece to its role

jwt.sign

Creates token
jwt.verify

Validates token
token

Signed data
secret

Secret key
What does JWT provide?
- File compression
- Network acceleration
- Stateless authentication
- A database connection
Show answer

Stateless authentication — JWT provides stateless authentication.

Next lesson: Summary - Security

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies