What is a JWT (JSON Web Token) and why your REST API needs it

Hello everybody I'm Nick and today I will explain what is a JWT (JSON Web Token) and why your REST API needs it.

Don't forget to comment, like and subscribe :)

What is JSON Web Token, How JWT is created, Why is JWT used, Where JWT is used, What is JWT Payload, What is JWT Header.

Social media:

#tutorial #jwt #auth

[Azukayoshi]

Love the whiteboard presentations Nick, really helpful and well explained.

[femus]

Clear explanation and presentation, thank you

[joancamilomina]

Very clear and concise explanation, Thanks Nick, keep up the good work !

[Gomide]

I liked the whiteboard, thank u for the explanation of this concept. Very clear and simple. Also, very helpful to complement the tutorial series. Thanks a lot.

[wanderingchestnut]

Very clear explanation. I really love your work. Thank you Nick.

[eniluck]

Thanks for explaining and comparison of jwt and cookie.

[secretmind]

Simple and straight to the point, thank you.

[caikhenrik]

thats a realy good video. Nice work and keep doing videos!

[funkel]

doing a video on an implementation of this would also be great.
It would also be cool to see a video on the use of that auto mapper tool you've talked about a few times. learning how to use that would save tons of time. Also, while I'm not sure how popular it would be on youtube but showing some unit testing, especially of your posts service, would be a great help. Unit testing entity framework is annoying.

[twiksify]

5:10 Since the header is in clear text an attacker can change the header to forge a token. A malicious user may replace the hash key, inject a key and change alg, even none is valid alg which completely bypasses the validation.

Please do not trus the header, instead rely on the hash key used during creation of the token.

[yele]

Hi, Nick, thanks for the video.
I have a question:
With Jwt, Although we dont have to store session/state on each machine, we must store the secret along with a method that checks the token validity on each machine.
Having said that, is jwt better than session/state (for that specific aspect)?

[shashankpandey]

please make a video on identity server

[murunwascengy]

Very helpful, can you please share a github link for source code?

[InCircle]

Can we have video on AD Authentication in Web API .net core ?

[MrTalhakamran]

It still doesn't make any sense.
How is it different then sending password. I mean if someone hacks my computer and copies the JWT, he/she can access my account on website?

[livelaurent]

Using a cluster as a reason why JWT are even existing is wrong… Clusters are very easy way to handle that (shared session storage etc.), this video is misleading a lot of people by explaining a reason for JWT that is not really a good reason. (I’m not going to explain it but people should look at some resources, one of the main reason is about distributed system and that cannot always authenticate you against the original system for instance, or having tickets with only a specific set of claims etc.. but Load balancing is def. NOT a reason why JWT exists, there are so many ways to handle that and it was there way before JWT)

[lucisaeterna]

'How to implement Google/Microsoft/Twitter... authentication?'