|
JSON Web Token (JWT) is a JSON-based open standard (RFC 7519) for passing claims between parties in web application environment. The tokens are designed to be compact, URL-safe and usable especially in web browser single sign-on (SSO) context. JWT claims can be typically used to pass identity of authenticated users between an identity provider and a service provider, or any other type of claims as required by business processes. The tokens can also be authenticated and encrypted. JWT relies on other JSON-based standards: JWS (JSON Web Signature) RFC 7515 and JWE (JSON Web Encryption) RFC 7516. ==Structure== Token is a set of claims (JSON fields). The following example token, issued by ''Identity Provider'', states that ''John Doe'' is an administrator: A claim set can be sent with an authentication header, declaring a cryptographic message authentication code (HMAC with SHA-256 in the following example): After canonicalization both structures are encoded as Base64 and the declared message authentication code is calculated over the encoded string. The output is three Base64 strings separated by dots that can be easily passed in HTML and HTTP environments, while being more compact compared to XML-based standards such as SAML. Typical cryptographic algorithms used are HMAC with SHA-256 (HS256) and RSA signature with SHA-256 (RS256). JWA (JSON Web Algorithms) RFC 7518 introduces many more for both authentication and encryption. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「JSON Web Token」の詳細全文を読む スポンサード リンク
|