Why is JWT popular?

Animation tools: Adobe Illustrator and After Effects.

Checkout our bestselling System Design Interview books:

ABOUT US:
Covering topics and trends in large-scale system design, from the authors of the best-selling System Design Interview series.

[sandipb]

Important thing to remember, is that when an user logs out, the JWT is still usable. The log out process just removes it from client cookies/local storage. So unless the server application has implemented token blacklisting on logout, a malware can still use the jwt till it expires.

[rasmusjensen]

This is a good intro to JWTs. Although, I do think that JWT, oauth and oidc is being somewhat mixed together. JWT's does not necessarily provide authorization or authentication. JWT is just a standard for signing JSON claims.

[neeleshsalian]

It amazed me when I heard it is pronounced as "jot"

[ReflectionOcean]

- Understand JWT structure and usage (0:34)

- Ensure sensitive payload data is encrypted (2:02)

- Choose the right signing algorithm for your needs (2:17)

- Implement best practices for JWT security (4:02)

[animanaut]

one antipattern i witnessed is to put stuff into the payload that would rather belong into a rest path. like a for example GET for a particular resource where the resource key/resource had to be provided via payload instead of rest path. there is potential for missuse like that too, not only security.

[pif]

I still fail to understand the security part of JWTs. If they are sent as unencrypted headers and can be easily stolen why should we rely on them for user authentication and by consequence for authorization?

[maratchardymov]

Nice video, but I'd love to see comparison with cookies, for example cookies are used as default session store in Rails and can be stateless as JWT

[rotatopotato]

Your voice is so calming. Thank you for another great lesson!

[tinnick]

As third party cookies are being deprecated in favor of FedCM, even with JWT we will not be able to implement SSO around mid 2024.

JWT can still be used for logins without SSO though.

[smritisharan-sfdcamplified]

excellent work and presentation. May i ask which TOOL HAS BEEN USED FOR ANIMATION?

[punpompur]

Couldn't agree more. Session management with JWT was a problem for me in a project because for one of the clients they wanted only one active session for a user.

[jacobwwarner]

Good short form video summary. Its more conceptual rather than technical, so i think the delivery method fulfilled the overall purpose.

[nyantaro]

Excellent video. What is the ideal way to authenticate and authorize these days?

[rahulsalivendra]

Hi, what are various ways we can encrypt and decrypt the payload using jwt?

[gus]

Really good, understandable explanation (plus your superior graphics)! Thanks! 😎✌️

[ianokay]

It doesn't make any sense to suggest hijacking is a failure of JWT ("vulnerable to theft") since it's just an access token (with verifiably authentic user information). Access tokens could be hijacked as well, so it's no better or worse than the alternatives as a Bearer token. ☝🤔

[SoyJavero]

Does anybody know how to make does incredible diagrams with animations whatever? Please

[Yorgarazgreece]

i always pronounced them jay double u tees. first time i am hearing joughts lol

[luisxd]

Great video, everything was well explained, thanks!

[TobiasSette]

I missed an example showing how to not use JWT in sessions