JWT (JSON Web Token)
A JSON Web Token (JWT), defined in RFC 7519, is a compact, URL-safe format for representing a set of claims -- statements like who a token was issued to, who issued it, which audience it's valid for, and when it expires -- as a signed (or optionally encrypted) string of three parts, base64url-encoded and separated by dots: a header, a payload of claims, and a signature. Because the signature is computed over the header and payload together, any party holding the issuer's public key (or shared secret, for symmetric algorithms) can verify a JWT wasn't altered after issuance without needing to call back to the issuer for every check, which is what makes it a popular format for OAuth 2.0 access tokens and ID tokens passed between a client, an authorization server, and a resource server. A JWT's audience claim is exactly the field an audience-bound token check relies on to catch token passthrough: a server validating that claim can reject a token that was issued for a different recipient, rather than trusting any validly signed token regardless of who it actually names. A JWT being signed only guarantees its contents weren't tampered with; unless it's also encrypted, the claims inside are readable by anyone who obtains the token, which matters for what gets placed in one.
By AdminKit team, Netbase JSC · Updated