JWT Handbook

by Sebástian Peyrott

Ever wondered how JSON Web Token came to be and what problems it was designed to tackle? Are you curious about the plethora of algorithms available for signing and encrypting JWTs? Or are you interested in getting up-to-speed with JWTs as soon as possible? Then this handbook is for you.

Genres: Software, Technology, Programming, Nonfiction

118 pages, ebook

Reviews

[eri b.❀ · Rating 2 out of 5]

[...] all JTWs are constructed from three different elements: the header, the payload, and the signature/encryption data.

This was a nice introduction for JWT, but I'd certainly recommend some background on cybersecurity and encryption in general, to make the most of the chapter about algorithms (which was very interesting). Honestly, I think it would have been better for me if I started following tutorials and then read the book to learn more about the technical part and better practices. Still, a good overview of JWT.

[Colin Jones · Rating 4 out of 5]

Good (and free!) overview of JWT - I’ve been wary of this whole ecosystem, despite its popularity, based on strong opinions from infosec folks on my twitter feed and wanted to understand both sides better. I found myself increasingly uncomfortable with the number of knobs in JWT and related techs as I went through this book, and since this comes from an OAuth/JWT service provider, that probably jives w/ their incentives! At any rate, I definitely recommend it for folks considering JWT, particularly Chapter 8 “best practices” - essentially a catalog of vulnerabilities to avoid creating, based on https://tools.ietf.org/html/draft-iet...

[Siarhei Krukau · Rating 3 out of 5]

It's short, it's free. It should be a documentation block on their site with appropriate links to other resources for the cryptographic algorithms instead of partial and non-complete JS implementations.

[Luboš · Rating 3 out of 5]

A good little handbook which covers the architecture of JSON Web Token. Available for free. Examples focused on JavaScript.

[Scott Pearson · Rating 4 out of 5]

For those unaware (like me earlier this week), JWT stands for JSON Web Token. JSONs are a standard formats computers on the Internet exchange data in. JWTs are a standardized way to pass encrypted information from a client to a server to prevent tampering. To provide security, it uses modern encryption tools along with a signature and information stored in the header of a web transaction. Thus, web users cannot tamper with information for malicious purposes.

A developer at work suggested using this standard on a project, and unaware of the term, I thought I should read up about it. This free book hit the spot and educated me about this standard. Developers have hacked their own solutions to this problem for a long time, and I welcome a common, secure standard that everyone can use. This book explains the standard in depth with a lot of JavaScript code for developers to get started.

[Héctor Iván Patricio Moreno · Rating 3 out of 5]

It is a good introduction to what JWT and its associated standards are, it covers all you need to know about JWT as an implementer of the standard for your own language (although I think this would be rare).
What I didn't like at all is the examples of the cryptographic algorithms the bare explanations and the code that is almost incomprehensible. And since it isn't the core of the book, I think that part should be avoided or expanded to cover it much better, with other examples.

Also, some of the examples of the first chapter are redundant and give so little information.

I would recommend only the first 4 or 5 chapters as and very thorough intro to JWt.

[Viktor Malyshev · Rating 3 out of 5]

A small, really small book on the basics of JWT, a good one, to be honest. I'd like to see more on oAuth and OpenID, but everything else is quite good. I was really impressed by how many out of JWT world I use these days - good reminder.
Recommend to all beginners in the JWT world, just to explore and understand it.

[André Gomes · Rating 4 out of 5]

Very nice deep-dive into JWT anatomy