JSON Web Tokens crash course - JWT tokens explained

00:00 Introduction to JSON Web tokens
01:42 The purpose of digital signatures with JWTs
03:49 How to create digital signatures
08:37 Types of JWTs: JSON Web Signature vs JSON Web Encryption
12:50 JWTs in action: server to server communication
13:58 Using JWTs for client side sessions
17:17 Using JWTs with OAuth2, OpenID Connect and single sign on (SSO)
18:25 Using JSON Web Encryption (JWE) for end-to-end encryption
22:00 Building blocks of a JSON Web Signature (JWS) token
22:56 JWT JOSE header
25:38 JWT claim set explained
26:47 How to create a JSON Web Signature
31:54 JWT compact serialization format
34:22 HMAC vs RSA-based JSON Web Signature Tokens
36:40 HMAC-based JWT tokens
38:50 RSA-based JWT tokens
40:17 How to implement a server to server communication with RSA JWT tokens
44:22 Summary and wrap up

In this video we cover what JSON Web Tokens are, what the difference between JSON Web Encryption (JWE) and JSON Web Signature (JWS) and for what these tokens are typically used.

[jgoebel]

Let me know what you think about this video.
Also if you have any video ideas, please post them here 👍

[jakegoldstein]

absolutely one of the best jwt videos or explanations in general I have come across. the entire time I had "ah-ha" moments of realization and understanding. Currently a student at Full-Stack Academy and we just had a lecture on this...you really tied it together for me thank you my friend

[shonzuhleezaycyclist]

Awesome content. A video on JWE please.

[Taragurung]

Hello Jan, how to generate PS256 signed payload using python?

[serdar.d]

Just to answer the question in min 12: Yes, a JWE video would be great (if you haven't already done it)

[beratdinckan]

Can I use jwt with "server to server communication" while using the API gateway with microservices?

[rezashadi]

was great, the best way to teach with examples

[PyMoondra]

So I watched this entire video again. So it seems, json web signatures are really only good for making sure content hasn't been changed (when two parties have shared key), as the signature key will also need to changed.

I didn't quite understand how json web signatures were useful with the login and redis example (though I am still learning the basics of web development). I will try watching that part again and see if it clicks.

[abdulazeez.]

Excellent video. You cleared so much confusion I had.

[DavidSmith-btmq]

Do you know of any C# examples for signing a Jwt with the private key?

[spirosmantzavinos]

Great overview. Very well organized and explained. Helped fill in some of the gaps in my JWT understanding. Thanks

[serjtubin]

Great content, thanks a lot! Subscribed :) Danke <3

[IranzinhoBRG]

Many thanks for this content, that's gold knowledge. It helped me a ton. Congrats for the good job with it

[johnm]

this is really good... can i be cheeky and ask how to get ahold of the diagrams?

[massimodaros]

A very useful video to refresh the security concepts involved in JWT

[hrithikkale]

can you explain adavantage of using RSAA over HMAC in terms of Vulnerability ?

[CatainaLopez]

Thank you very much for this amazing series. Great content Jan!

[johncarlofababeir]

Well Explained Structure, I recommend you guys to watch it.

[DieGame]

Thank you for the explanation, very good presentation.

[mhmdld]

Really informative video, keep going..