JSON Web Token Architecture: RFC 7519 & Cryptographic Signatures
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. Standardized under IETF RFC 7519, JWTs are ubiquitously used for OAuth 2.0 bearer authorization, microservice authentication headers, and stateless session tokens.
1. HMAC-SHA vs Asymmetric Public-Key Signatures
- HS256 (Symmetric): Both the token issuer and consumer share the same secret key. Extremely fast, lightweight, and ideal for internal microservice clusters.
- RS256 / ES256 (Asymmetric): The issuer signs with a Private Key, and external third parties verify using a Public Key (JWKS).
Frequently Asked Questions (FAQ)
How does HMAC-SHA256 (HS256) token signing work?
HS256 calculates a cryptographic hash over the Base64Url-encoded header and payload using a shared secret key: HMACSHA256(base64Url(header) + '.' + base64Url(payload), secret). This ensures the payload cannot be tampered with in transit.
Are my secret keys sent to your server?
Never. All cryptographic HMAC operations use the browser's native Web Cryptography API (window.crypto.subtle.sign). Your secrets never leave your device's memory.
What standard claims should be included in a JWT payload?
Standard RFC 7519 registered claims include: 'sub' (Subject/User ID), 'iat' (Issued At timestamp), 'exp' (Expiration timestamp), 'iss' (Issuer), and 'aud' (Audience).