Introducing JWTs

According to Request for Comments (RFC) 7519 (https://tools.ietf.org/html/rfc7519):

"A JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair."

A JWT token consists of three parts separated by dots, as depicted in the following screenshot:

Figure 4.6 – JWT parts

The header indicates the algorithm used to generate the signature. The payload contains information about the user, along with the token expiration date. Finally, the signature is the result of hashing the header and payload parts with a secret key.

Now that we've seen how JWT works, let's integrate it into our API. To get started, install the JWT Go implementation with the following command:

go get github...