JWT server to server communication #2 | JSON Web Tokens

Learn how to setup a server to server communication with JWTs (JSON Web Token) and the HMAC digital signature algorithm for JSON Web Signature (JWS) tokens.

This is part 2 of this tutorial series in which we start building the middleware that will block requests with invalid or missing JWT tokens.

00:00 config for shared HMAC JWT secret
01:33 JWT authentication middleware
02:46 Locating JWTs in a HTTP request
04:29 Authorization headers
04:54 blocking unauthorized requests
05:25 extract JWT token from Authorization header
06:25 removing Bearer prefix from Authorization header
08:28 create token service to verify a JWT token

[jgoebel]

Let me know what you think about this video.
Also please feel free to post any video ideas 👍

[PyMoondra]

I'm only 1 min in, but I assume the secret should be saved in a environment variable?

[josephconnolly]

Really enjoying these videos. I'd be surprised if the viewers needed a refresher on how substring works. "I'm going to clip the first 8 characters off with substring", would have been more than enough time on the subject.