interview

home / developersection / interviews / jwt working process

Ask Question

JWT working process

ICSM Computer 207 27-Jul-2025

authentication authorization jwt

Updated on 27-Jul-2025

ICSM Computer

IT-Hardware & Networking

Ravi Vishwakarma is a dedicated Software Developer with a passion for crafting efficient and innovative solutions. With a keen eye for detail and years of experience, he excels in developing robust software systems that meet client needs. His expertise spans across multiple programming languages and technologies, making him a valuable asset in any software development project.

Can you answer this question?

Answer

1 Answers

ICSM Computer

27-Jul-2025

JWT Working Process Guide

1. Client Logs In

User sends username and password or credentials to the server (typically in a POST to /login).

Below is an example of a POST request to /login.

POST /login
{
  "username": "john",
  "password": "123456"
}

2. Server Validates and Generates JWT

If credentials are correct, the server generates a JWT token that contains a payload (user details, roles, expiry, etc.)
Server signs the JWT using a secret key.

JWT Example Structure (3 parts):

xxxxx.yyyyy.zzzzz

xxxxx: Header (alg + type)
yyyyy: Payload (data such as user ID)
zzzzz: Signature (proves integrity)

3. JWT Sent to Client

The server returns the JWT in the response body or header.

{
  "token": "eyJhbGciOiJIUzI1NiIsInR..."
}

4. Client Stores Token

The client (typically browser/app) stores it in localStorage, sessionStorage, or cookies.

5. Client Sends JWT in Requests

For every subsequent request to secured endpoints, the client includes the token in the Authorization header:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...

6. Server Verifies JWT

The server verifies:
- Signature validity (via secret key)
- Token expiration (exp field)
- Optional claims such as aud, iss, etc.
In case of being valid, access is permitted.

7. If Token Invalid/Expired

Server sends back 401 Unauthorized.

Example JWT Payload (Decoded)

{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",
  "exp": 1722460400
}

Security Tips

Use HTTPS always.
Store the secret key securely.
Use short expiration (exp) for access tokens.
Use refresh tokens if required for re-authentication.

interview

JWT working process

ICSM Computer

Can you answer this question?

1 Answers

JWT Working Process Guide

1. Client Logs In

2. Server Validates and Generates JWT

3. JWT Sent to Client

4. Client Stores Token

5. Client Sends JWT in Requests

6. Server Verifies JWT

7. If Token Invalid/Expired

Example JWT Payload (Decoded)

Security Tips

Liked By