Today, applications are built around identity systems. All API gateways, microservices, mobile backends, and single sign-on flows require some form of authentication and authorization. That trust is often conveyed via a JSON Web Token (JWT) in many systems.
Their compactness, portability, and ability to be easily verified within distributed systems make them popular. A service can accept a token, validate its signature, verify the claims of the token (expiration, audience, subject, and issuer), and determine if the request should be accepted.
This article has been indexed from DZone Security Zone
Read the original article: