Instructor: So again,
here is the OAuth2 Flow we discussed.
We see the redirection,
we see the permission granting,
and we see the access token.
So remember the access token is
a token returned by the authorization server.
And that the client app is sending to the resource server.
In order for the user to be identified.
So what exactly is this access token?
So with OAuth2 protocol,
the access token is something called JWT.
So what is exactly JWT?
JWT is an acronym.
Stands for JSON Web Token.
And its a small string containing the data
the server needs in order to authenticate the user.
So, this token is returned by the OAut2 authorization server
and it contains everything the API or the server needs
so that it will know exactly who the user is
and what is he allowed to do.
So, how exactly does a JWT looks like?
So, the JWT has three sections.
The first one is the header.
The header contains the type of token,
usually JWT
and the signing algorithm used to signed the JWT.
For example, here is the typically JWT header.
So you see the type,
which is in the typ field
and it is JWT.
And the algorithm which is in this case
HS256.
So this is the first section, the header.
The second section is the Payload.
So the Payload containing the actually data about the user,
that the server needs in order to make a decision
whether the user can access the resource or not.
Now there isn't a standard format of the Payload.
So basically you can put there whatever you want.
And here is a typical example of how the Payload looks like.
So you can see here the name of the user,
in this case John Doe.
And its role
which is admin.
And some more data like the sub-organization number.
So this is a Payload
and this is the most important part of the JWT
again, because it contains the actual data on the user.
That the API needs.
The last section is the Signature.
So the JWT is signed electronically
so that it can't be tampered with during the transfer
from the authorization server to the API.
Now the three parts of the JWT are encoded
using Base64 algorithm and are concatenated with a dot.
So a typical JWT will look like this.
Note the three parts,
they are color coded.
And also note the dot separating the various parts.
The first part is the header,
of course encrypted in and encoded.
The second part is the Payload
and the last part is the Signature.
Now you can easily examine JW tokens
and even construct some for yourself.
Using the JWT Debugger.
So, lets take a look at it.
And we will go to
JWT.io
and lets scroll down.
And what you see here is the JWT Debugger.
So here,
we can see the header,
the Payload,
and the Signature.
Which we won't deal with.
And now lets modify the Payload.
And see what happens here.
This is a real time representation of the JWT
created from this data.
So, for example,
I'll modify the name to be mine.
Mimi Levine.
And you see that the result token is changing as I write.
So this is a great playground to find out how JWT will
look like in specific scenarios.
So, feel free to play here.
And try various types of data in the JWT
and see what happens.