ASP.NET Core Web API Interview Question #54

What is JWT?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

JWT stands for JSON Web Token. It is a compact token format that can carry claims and can be cryptographically signed so a server can verify that the token has not been altered.

Detailed Explanation

JWT stands for JSON Web Token. It is a compact token format that can carry claims and can be cryptographically signed so a server can verify that the token has not been altered.

JWTs are commonly used as bearer access tokens for APIs. A JWT is not automatically secure merely because it is encoded; the API must validate its signature, issuer, audience, lifetime, and other required properties.

Code Example

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

// Typical claims:
// sub  -> subject/user identifier
// exp  -> expiration
// iss  -> issuer
// aud  -> audience