Understanding JWT Tokens and OAuth2: A Beginner’s Guide

Two widely adopted technologies that handle these concerns are JSON Web Tokens (JWT) and OAuth 2.0. While they are often used together in modern web applications, they each serve different purposes. In this blog, we’ll explore what JWT tokens and OAuth 2.0 are, how they work, and how they can be used to enhance the security of your applications.

What is JWT (JSON Web Token)?

A JWT (JSON Web Token) is a compact, URL-safe way to represent claims (i.e., information) between two parties. It’s used extensively for authentication and authorization purposes in modern web applications. JWTs are typically used to securely transmit information between a client and a server, allowing the server to verify the client’s identity and grant access to protected resources.

Structure of a JWT

A JWT is made up of three parts:

1. Header: The header typically contains two parts:
   • Type: Identifies the token type (e.g., “JWT”).
   • Algorithm: Specifies the signing algorithm used (e.g., “HS256” or “RS256”).
   Example of a header:

{
“alg”: “HS256”,
“typ”: “JWT”
}

2.Payload: The payload contains the claims — statements about an entity (usually the user) and additional data. Claims can be:

• Registered claims: Predefined claims like sub (subject), iat (issued at), and exp (expiration).
• Public claims: Custom claims agreed upon by the sender and receiver.
• Private claims: Custom claims used for sharing information between parties.

Example of a payload:

{
“sub”: “1234567890”,
“name”: “John Doe”,
“iat”: 1516239022
}

3.Signature: The signature is created by taking the encoded header and payload, signing them with a secret key using the specified algorithm. This ensures the integrity of the JWT and verifies that it hasn’t been tampered with during transmission.

Example of a JWT signature:

HMACSHA256(
base64UrlEncode(header) + “.” +
base64UrlEncode(payload),
secret)

When you combine all three parts (Header + Payload + Signature), you get a JWT like this:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

How Does JWT Work?

JWTs are usually used in stateless authentication systems. When a user logs in, the server generates a JWT with the user’s identity and other claims, signs it with a secret key, and returns the token to the client. The client stores this token (typically in localStorage or sessionStorage) and includes it in the Authorization header for future API requests:

Authorization: Bearer

The server can then decode the JWT and verify the signature using the secret key, ensuring the authenticity and integrity of the token. If the token is valid, the server processes the request and grants access to the requested resource.

What is OAuth 2.0?

OAuth 2.0 (Open Authorization 2.0) is an authorization framework that allows third-party applications to access resources on behalf of the user without exposing the user’s credentials. OAuth 2.0 is widely used for delegated access scenarios, such as when a user wants to grant an external app access to their account on another platform (e.g., allowing a third-party app to access your Google Calendar without sharing your Google account password).

Key Components of OAuth 2.0

1. Resource Owner: The entity (usually the user) who owns the data and can grant access to it.
2. Client: The application that wants to access the resource on behalf of the resource owner.
3. Authorization Server: The server that authenticates the resource owner and issues access tokens to the client.
4. Resource Server: The server that hosts the protected resources and validates the access tokens issued by the authorization server.

OAuth 2.0 Authorization Flow

OAuth 2.0 provides several flows for different use cases. The most common flow is the Authorization Code Flow, which works as follows:

1. Authorization Request: The client redirects the resource owner to the authorization server’s authorization endpoint.
2. Authentication: The resource owner authenticates and authorizes the client to access their resources.
3. Authorization Code: The authorization server redirects the resource owner back to the client with an authorization code.
4. Token Exchange: The client sends the authorization code to the authorization server’s token endpoint, along with client credentials (e.g., client ID and secret), to obtain an access token.
5. Access Resource: The client uses the access token to request the protected resource from the resource server.

OAuth 2.0 access tokens are usually short-lived and are used to access the resources. To extend access, refresh tokens are often issued, which allow the client to obtain a new access token without requiring the user to re-authenticate.

JWT and OAuth 2.0: How They Work Together

While JWT and OAuth 2.0 serve different purposes, they often work together to provide secure and scalable authentication and authorization mechanisms in modern applications.

1. JWT as an Access Token: In OAuth 2.0, the access token that the authorization server issues is often a JWT. This token contains information about the authenticated user and their permissions. Since JWTs are self-contained (i.e., they carry all the necessary information), they eliminate the need for the server to maintain session state. This makes JWT a good fit for OAuth 2.0’s stateless nature.
2. Authorization Flow: OAuth 2.0 is responsible for the authorization part — ensuring that the user has granted permission for the client to access resources. Once authorized, OAuth 2.0 issues a JWT (access token), which is then used by the client to authenticate API requests.
3. Token Validation: JWTs are self-verifiable. This means that the resource server can validate the JWT without needing to contact the authorization server. The server simply checks the JWT’s signature using the secret key or public key to ensure it hasn’t been tampered with and that it’s still valid (i.e., hasn’t expired).

Benefits of Using JWT and OAuth 2.0 Together

1. Stateless Authentication: Since JWTs are self-contained and contain all the information needed for authentication, OAuth 2.0 can be used with stateless API architectures, where no session data is stored on the server.
2. Scalable and Secure: OAuth 2.0 and JWT provide a scalable solution for managing access to APIs. OAuth allows for delegated access, while JWT ensures secure and verifiable authentication.
3. Flexible: OAuth 2.0’s different authorization flows, combined with JWT’s compact token format, make it a versatile choice for mobile apps, web apps, and third-party integrations.

Common Use Cases for JWT and OAuth 2.0

1. Single Sign-On (SSO): OAuth 2.0, with JWT as the access token, is commonly used to implement Single Sign-On, where users can authenticate once and access multiple applications without re-entering their credentials.
2. API Authorization: JWT is used to securely authenticate API requests in OAuth 2.0, allowing third-party apps to access resources without exposing user credentials.
3. Mobile Applications: OAuth 2.0 with JWT is ideal for mobile apps, where tokens are securely stored and used to authenticate API requests on the mobile device.

Conclusion

JWT and OAuth 2.0 are powerful tools for building secure and scalable web applications. JWT simplifies the authentication process by providing self-contained tokens that can be easily validated, while OAuth 2.0 handles authorization, ensuring that users can safely delegate access to their data without sharing their credentials.

By combining JWT and OAuth 2.0, you can create a secure and efficient authentication and authorization system for your applications. Whether you’re building APIs, mobile apps, or third-party integrations, understanding how these technologies work together is essential for modern web security.