How does JWT work

[arunshankars]

To those who find it tough, think of how you would hand over your bag to the security guard when you are about to enter a super market, and he returns a token to you. When you exit, you have to hand over the token to him, and he will let you access your 'resource'. The responsibility of not losing the token is with the customer (client). The security guard (server) will give access to the customer (client) only after the particular token is produced by it. The same works with JWT tokens.

If the customer gives the token to someone else, who then produces it to the security guard, the security guard will give access to the bag (resource) to the guy who produced the token. So, clients shouldn't share their JWT tokens with others
.

[thewatcher]

explained everything is such short time. Thanks brother

[whatsinaname]

I spent months trying to figure wtf is jwt and this was the only video that hit the nail on its head

[pratikdhande]

very nice short and clear explanation. impressed

[scottsmyth]

what's up with the dislikes ? Video was crystal clear.

[MyApanas]

Short, informative and nice to watch. We need more explanations like this on youtube! Thanks man.

[mahmoudhasan]

The most helpful, useful and summarized explain i have ever seen !!

[nghiaphanthanh]

Brief, useful, informative one. Thank you/

[gabrielluca]

Is it true that jwt has an open time window for an attacker to use equal to the expiration time of the token if he manages to intercept the token ?

[Robin-uuwx]

Wasn't it best practice to send sensitive data like passwords through a POST request instead of a GET?

[Jinsh]

Is the server here typically is the Identity Provider (like Azure Active Directory for example)?

[TBadalov]

How do you know if the client is sending not someone else's token? I am not talking about tampered token. I mean someone fully copies the token with its signature. In your case JWT is equivalent to simply sending some session token stored in a database.

[erickramones]

thanks, it is a great tutorial about jwt.

[davidbiro]

This is not how it works. This is how to use. For that purpose this was perfect, but I already knew that.

[imichael.]

This is a really bad description of JWT.

[kaustubhdwivedi]

Overall summary : Clients can not be trusted.

[lukasglaser]

this description is very bad and incomplete

[glacy]

This information can be found in google in 30 seconds. And it's 2 times faster than watching this video.