ASP.NET Core Web API Interview Question #55

What are the main parts of a JWT?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

A JWT commonly consists of three Base64URL-encoded sections separated by dots: header, payload, and signature. The header identifies metadata such as the signing algorithm, the payload contains claims, and the signature protects integrity.

Detailed Explanation

A JWT commonly consists of three Base64URL-encoded sections separated by dots: header, payload, and signature. The header identifies metadata such as the signing algorithm, the payload contains claims, and the signature protects integrity.

The payload is encoded rather than encrypted by default. Sensitive secrets should therefore not be placed in an ordinary JWT payload.

Code Example

header.payload.signature

// Conceptually:
{
  "alg": "RS256",
  "typ": "JWT"
}