---
title: "JWT working process"  
description: "JWT working process"  
author: "ICSM Computer"  
published: 2025-07-27  
updated: 2025-07-27  
canonical: https://www.mindstick.com/interview/34341/jwt-working-process  
category: "authentication"  
tags: ["authentication", "authorization", "jwt"]  
reading_time: 3 minutes  

---

# JWT working process

## JWT Working Process Guide

### 1. Client Logs In

User sends username and password or credentials to the server (typically in a POST to `/login`).

Below is an example of a POST request to `/login`.

```plaintext
POST /login
{
  "username": "john",
  "password": "123456"
}
```

### 2. Server Validates and Generates JWT

- If credentials are correct, the server generates a **JWT token** that contains a **payload** (user details, roles, expiry, etc.)
- Server signs the JWT using a **secret key**.

## JWT Example Structure (3 parts):

```plaintext
xxxxx.yyyyy.zzzzz
```

- xxxxx: Header (alg + type)
- yyyyy: Payload (data such as user ID)
- zzzzz: Signature (proves integrity)

### 3. JWT Sent to Client

The server returns the JWT in the response body or header.

```plaintext
{
  "token": "eyJhbGciOiJIUzI1NiIsInR..."
}
```

### 4. Client Stores Token

The client (typically browser/app) stores it in **localStorage**, **sessionStorage**, or **cookies**.

### 5. Client Sends JWT in Requests

For every subsequent request to secured endpoints, the client includes the token in the **Authorization header:**

```plaintext
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
```

### 6. Server Verifies JWT

- The server verifies:

   - Signature validity (via secret key)
   - Token expiration (exp field)
   - Optional claims such as aud, iss, etc.

- In case of being valid, access is permitted.\

### 7. If Token Invalid/Expired

Server sends back `401 Unauthorized`.

## Example JWT Payload (Decoded)

```plaintext
{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",
  "exp": 1722460400
}
```

## Security Tips

1. Use **HTTPS** always.
2. Store the **secret key securely**.
3. Use short expiration (exp) for access tokens.
4. Use **refresh tokens** if required for re-authentication.

## Answers

### Answer by ICSM Computer

## JWT Working Process Guide

### 1. Client Logs In

User sends username and password or credentials to the server (typically in a POST to `/login`).

Below is an example of a POST request to `/login`.

```plaintext
POST /login
{
  "username": "john",
  "password": "123456"
}
```

### 2. Server Validates and Generates JWT

- If credentials are correct, the server generates a **JWT token** that contains a **payload** (user details, roles, expiry, etc.)
- Server signs the JWT using a **secret key**.

## JWT Example Structure (3 parts):

```plaintext
xxxxx.yyyyy.zzzzz
```

- xxxxx: Header (alg + type)
- yyyyy: Payload (data such as user ID)
- zzzzz: Signature (proves integrity)

### 3. JWT Sent to Client

The server returns the JWT in the response body or header.

```plaintext
{
  "token": "eyJhbGciOiJIUzI1NiIsInR..."
}
```

### 4. Client Stores Token

The client (typically browser/app) stores it in **localStorage**, **sessionStorage**, or **cookies**.

### 5. Client Sends JWT in Requests

For every subsequent request to secured endpoints, the client includes the token in the **Authorization header:**

```plaintext
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
```

### 6. Server Verifies JWT

- The server verifies:

   - Signature validity (via secret key)
   - Token expiration (exp field)
   - Optional claims such as aud, iss, etc.

- In case of being valid, access is permitted.\

### 7. If Token Invalid/Expired

Server sends back `401 Unauthorized`.

## Example JWT Payload (Decoded)

```plaintext
{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",
  "exp": 1722460400
}
```

## Security Tips

1. Use **HTTPS** always.
2. Store the **secret key securely**.
3. Use short expiration (exp) for access tokens.
4. Use **refresh tokens** if required for re-authentication.


---

Original Source: https://www.mindstick.com/interview/34341/jwt-working-process

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.