Products

Data Converter Cleaner TUC - Unit Converter Import Export Survey Manager Tweet Controller

Developer

Article Blog Forum Interview Beginner News Startup Quiz

Users

Career

Apply Job Internship

Pricing

JWT working process

ICSM Computer 546 27 Jul 2025

1 Answers

ICSM Computer 27 Jul 2025

JWT Working Process Guide

1. Client Logs In

User sends username and password or credentials to the server (typically in a POST to /login).

Below is an example of a POST request to /login.

POST /login
{
  "username": "john",
  "password": "123456"
}

2. Server Validates and Generates JWT

If credentials are correct, the server generates a JWT token that contains a payload (user details, roles, expiry, etc.)
Server signs the JWT using a secret key.

JWT Example Structure (3 parts):

xxxxx.yyyyy.zzzzz

xxxxx: Header (alg + type)
yyyyy: Payload (data such as user ID)
zzzzz: Signature (proves integrity)

3. JWT Sent to Client

The server returns the JWT in the response body or header.

{
  "token": "eyJhbGciOiJIUzI1NiIsInR..."
}

4. Client Stores Token

The client (typically browser/app) stores it in localStorage, sessionStorage, or cookies.

5. Client Sends JWT in Requests

For every subsequent request to secured endpoints, the client includes the token in the Authorization header:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...

6. Server Verifies JWT

The server verifies:
- Signature validity (via secret key)
- Token expiration (exp field)
- Optional claims such as aud, iss, etc.
In case of being valid, access is permitted.

7. If Token Invalid/Expired

Server sends back 401 Unauthorized.

Example JWT Payload (Decoded)

{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",
  "exp": 1722460400
}

Security Tips

Use HTTPS always.
Store the secret key securely.
Use short expiration (exp) for access tokens.
Use refresh tokens if required for re-authentication.

Markdown for AI

A clean, structured version of this page for AI assistants and LLMs.

Open .md

interview