Introduction

This chapter introduces how JSON Web Tokens (JWT) can be safely used to carry client information to allow Resource Servers to locally validate access tokens. This chapter will guide you through the usage of JWT and its corresponding representations such as JWS and JWE that respectively define integrity protection and confidentiality of the JWT payload. There are also some advanced topics being covered, such as how to use asymmetric signatures and how the client can prove the possession of a given access token.

Note

It's important to bear in mind that even though we are signing or encrypting the JWT payload, all the connections must be performed using TLS/SSL in production. We are not using TLS/SSL just because of didactical reasons.