JSON Web Token

JSON Web Token
Name	JSON Web Token
Developer	IETF Internet Engineering Task Force
Released	2015 (RFC 7519)
Programming language	Language-agnostic (implementations in JavaScript, Python (programming language), Java (programming language), Go (programming language), C (programming language))
Platform	Cross-platform
License	Varies by implementation (open-source implementations under MIT License, Apache License 2.0)

JSON Web Token is a compact, URL-safe means of representing claims to be transferred between two parties. It provides a standardized format for encoding claim sets and applying integrity protection or confidentiality using cryptographic algorithms. JSON Web Token is widely used in web authentication, authorization, and distributed systems integration.

History

JSON Web Token emerged from work within the Internet Engineering Task Force and related identity communities during the early 2010s. Development followed earlier efforts such as SAML 2.0, OAuth 2.0, and OpenID Connect integration needs, with formalization in RFC 7519 published by the IETF in 2015. Key contributors and implementers included engineers and organizations involved with Auth0, Okta, Microsoft, Google, and Mozilla Foundation, who drove adoption across cloud services and platform identity stacks. The specification evolved alongside related IETF standards like RFC 7515 and RFC 7516 and influenced commercial offerings from Amazon Web Services, Facebook, and Apple Inc..

Specification and Structure

The specification defines a token as three dot-separated Base64URL-encoded parts: header, payload, and signature, following principles similar to those in RFCs from the IETF working groups. The header contains metadata such as the cryptographic algorithm identifier (e.g., RS256, HS256) and token type, linking implementation choices to cryptographic providers like OpenSSL and libraries in ecosystems maintained by Linux Foundation projects. The payload carries claims—registered claim names like "iss", "sub", "aud", "exp"—that map to identity and session concepts used by platforms such as Azure Active Directory, Google Identity Platform, and enterprise suites from IBM and Oracle Corporation. The signature (or MAC) binds header and payload using keys from public-key infrastructures exemplified by X.509 certificates, PKCS #11, and cloud key management services from HashiCorp and AWS Key Management Service.

Encoding uses Base64 variant Base64URL to ensure compatibility with HTTP headers and URIs used in integrations with NGINX, Apache HTTP Server, and reverse proxies in content delivery networks run by Akamai Technologies and Cloudflare. The specification references algorithm registries and interoperates with standards such as JSON (JavaScript Object Notation), influencing implementation choices in projects like Node.js, Django, and Spring Framework.

Usage and Implementation

JSON Web Tokens are commonly issued by authorization servers and consumed by resource servers in authorization flows defined by OAuth 2.0 and session paradigms used by Single sign-on providers such as Auth0, Okta, and Ping Identity. Implementations span web frameworks and platform services including Express.js, Flask (web framework), Ruby on Rails, ASP.NET Core, and microservice toolchains like Kubernetes and Docker. Clients embed tokens in HTTP Authorization headers (Bearer scheme) when calling APIs hosted by vendors like Stripe and Twilio or integrating with identity federations such as SAML-based identity providers and OpenID Connect relying parties.

Libraries and SDKs for JWT exist across ecosystems: jsonwebtoken for Node.js, PyJWT for Python, Nimbus JOSE+JWT for Java, and native implementations used by Google Cloud Platform and Microsoft Azure, enabling use cases from mobile apps on Android (operating system) and iOS to serverless functions on AWS Lambda and Azure Functions.

Security Considerations

Security guidance around token issuance, validation, and storage is informed by incidents and advisories from organizations such as CERT Coordination Center and platform vendors like Microsoft Security Response Center. Critical considerations include secure key management using Hardware Security Modules and certificate authorities like Let's Encrypt for TLS, algorithm choice to avoid insecure defaults, strict audience and issuer checks reflecting federated trust models in OpenID Foundation deployments, and proper handling of expiration and revocation to mitigate replay and token theft risks exploited in breaches affecting services like LinkedIn and Sony Pictures Entertainment. Attack vectors historically associated with tokens include algorithm confusion, signature stripping, and token replay; mitigations incorporate use of asymmetric keys (RSA, ECDSA), token binding techniques pioneered in IETF drafts, and deployment of token introspection endpoints as used by OAuth 2.0 authorization servers.

Operational security also involves transport protections (TLS) and secure client storage patterns advised by browser and platform vendors such as Google Chrome and Apple to reduce exposure in cross-site scripting incidents reported in CVE databases and security bulletins from vendors like Red Hat.

Extensions and Related Standards

JSON Web Token is part of a family of specifications defined by the IETF that includes JSON Object Signing and Encryption (JOSE) components: JSON Web Signature (JWS) and JSON Web Encryption (JWE), plus JSON Web Key (JWK) and JSON Web Algorithms (JWA). These standards interoperate with higher-level protocols such as OpenID Connect and are often combined with OAuth 2.0 profiles and token exchange protocols used by cloud identity services from Google Workspace, Microsoft 365, and Salesforce. Complementary initiatives include federated identity frameworks from the Kantara Initiative and enterprise identity suites from SailPoint and ForgeRock. Emerging work addresses provenance, confidentiality, and privacy extensions in IETF drafts and related research by institutions such as MIT and Stanford University exploring verifiable credentials and decentralized identity systems like projects endorsed by the World Wide Web Consortium.

Category:Internet standards