JSON Web Token - JWT Auth (URDU)

JWT stands for "JSON Web Token." It is a compact, self-contained way to represent information between two parties in a way that can be easily verified and trusted. JWTs are often used for authentication and authorization purposes in web applications and services. They are commonly used in scenarios where a user logs into a website and receives a token, which is then sent with each subsequent request to prove the user's identity and access rights.

Here are some key features and components of a JWT:

JSON-based: JWTs use a JSON (JavaScript Object Notation) format to represent the information they contain. This makes them easy to read and manipulate by both humans and machines.

Compact: JWTs are designed to be compact, which means they are relatively small in size and can be efficiently transmitted over networks.

Self-contained: The token contains all the necessary information about the user or the entity it represents, including claims about the user's identity and potentially other metadata. This makes JWTs self-contained, meaning that the server can validate and trust the information within the token without needing to check with a central database or session store.

Digital Signature or HMAC: JWTs can be signed using a secret key or a private key/public key pair, depending on the use case. This signature provides a way to verify the authenticity of the token and ensure it has not been tampered with. When a JWT is signed, it can be trusted by the recipient.

Claims: JWTs typically include a set of claims, which are statements about an entity (usually, the user) and additional data. There are three types of claims: registered, public, and private claims. Registered claims are predefined and include standard fields like "iss" (issuer), "sub" (subject), "exp" (expiration time), "iat" (issued at), and others. Public claims are defined by the JWT standard but can be used for custom purposes, while private claims are specific to the applications using the JWT.

JWTs are commonly used in authentication and authorization processes, such as Single Sign-On (SSO) solutions and in securing APIs. When a user logs in, the server issues a JWT that contains information about the user, such as their user ID and role. The client can then include this token in subsequent requests, and the server can validate it to grant or deny access to protected resources.

JWTs are a popular choice because they are stateless, meaning the server does not need to store session data for each user, which can make them more scalable. However, it's crucial to handle JWTs securely, especially when dealing with sensitive information, by using proper signing and validation mechanisms.
instructor
Ibtisam
0:00 - Start
0:12 - Login Directory & Page
0:34 - Secret / Admin Page
1:00 - POST API Route
9:25 - Generating Token / Store Token in Cookies
9:44 - Installing JOSE
10:55 - Generating Token
22:00 - Jose Documentation
23:20 - Calling Token
23:55 - Setting Token in Cookies in POSTMAN
26:12 - Setting Cookies in Website
38:10 - Middleware
40:40 - Middleware on Secret / Admin Page
43:40 - Token Error Handling
47:15 - useRouter / Redirecting (Not Token)
48:42 - useRouter / Redirecting (Token Found)
50:24 - Verify Token
56:50 - Clerk vs. NextAuth
57:50 - Sing Out (Server Action)
1:00:40 - Q & A