Introduction

JWT (JSON Web Token) is an open standard (RFC 7519) used to securely exchange information between two parties as a digitally signed JSON object. It is widely used in OAuth2, OpenID Connect (OIDC), REST APIs, microservices, mobile applications, Single Sign-On (SSO), and cloud-native applications.

Unlike traditional session-based authentication, JWT enables stateless authentication, allowing APIs to validate requests without storing user sessions on the server.

Modern identity providers such as Google, Microsoft Entra ID, Okta, Auth0, Keycloak, Amazon Cognito, and IBM Security Verify issue JWTs for secure authentication and authorization.

---

What You'll Learn

• What is JWT?
• JWT Structure
• Header, Payload, Signature
• Claims
• Signing Algorithms
• Token Validation
• Access vs Refresh Tokens
• JWT vs Session Authentication
• JWT in Spring Boot
• Enterprise Best Practices

---

JWT Authentication Architecture

sequenceDiagram
    participant U as User
    participant IDP as Identity Provider
    participant C as Client
    participant GW as API Gateway
    participant API as Protected API
    U->>IDP: Username / Password
    IDP->>C: JWT Token
    C->>GW: Request + Authorization: Bearer JWT
    GW->>GW: Validate JWT Signature
    GW->>API: Forward Request
    API->>C: Response

---

JWT Structure

flowchart LR
    H["Header\n(alg, typ)"] --> DOT1["."]
    DOT1 --> P["Payload\n(claims)"]
    P --> DOT2["."]
    DOT2 --> S["Signature\n(HMAC / RSA)"]

Example

xxxxx.yyyyy.zzzzz

---

1. What is JWT?

Answer

JWT (JSON Web Token) is a compact, URL-safe token used to securely transmit information between parties.

A JWT is digitally signed, allowing the receiver to verify its authenticity and integrity.

JWT is commonly used for:

• Authentication
• Authorization
• Identity propagation
• Single Sign-On
• API Security

---

2. What is the Structure of a JWT?

Answer

A JWT has three parts:

Header.Payload.Signature

Header

Contains metadata.

Example

{
  "alg":"RS256",
  "typ":"JWT"
}

Payload

Contains claims.

Signature

Protects against tampering.

---

3. What are JWT Claims?

Answer

Claims contain information about the authenticated user.

Standard Claims

• iss (Issuer)
• sub (Subject)
• aud (Audience)
• exp (Expiration)
• nbf (Not Before)
• iat (Issued At)
• jti (JWT ID)

Custom Claims

{
  "role":"ADMIN",
  "department":"Payments"
}

---

4. How does JWT Authentication work?

Answer

User Login
     │
     ▼
Identity Provider
     │
     ▼
Generate JWT
     │
     ▼
Client Stores Token
     │
     ▼
Authorization:
Bearer JWT
     │
     ▼
API Validates JWT
     │
     ▼
Protected Resource

The server validates the JWT signature before processing the request.

---

5. What is the Difference Between Access Token and Refresh Token?

Answer

Access Token	Refresh Token
Short-lived	Long-lived
Used for APIs	Used to obtain new Access Tokens
Sent on every request	Stored securely
Contains scopes	Not normally sent to APIs

---

6. What Signing Algorithms are Used in JWT?

Answer

Common algorithms include:

Algorithm	Type
HS256	Shared Secret (HMAC)
HS384	Shared Secret
HS512	Shared Secret
RS256	RSA Public/Private Key
ES256	Elliptic Curve
EdDSA	Edwards Curve

Recommendation

Enterprise systems generally prefer RS256 or ES256 because they separate signing and verification keys.

---

7. How is a JWT Validated?

Answer

A secure JWT validation process checks:

• Signature
• Expiration
• Issuer (iss)
• Audience (aud)
• Not Before (nbf)
• Algorithm
• Token format

Validation Flow

Receive JWT
      │
      ▼
Verify Signature
      │
      ▼
Validate Claims
      │
      ▼
Authorize Request

---

8. What is JWT Expiration?

Answer

JWTs should always have an expiration time.

Example

{
  "exp":1785000000
}

Best Practice

• Access Token: 5–30 minutes
• Refresh Token: Longer lifetime with rotation

Never create tokens without expiration.

---

9. What is JWT Revocation?

Answer

JWTs are stateless and cannot usually be revoked once issued.

Common revocation strategies:

• Short expiration
• Refresh Token rotation
• Token blacklist
• Token versioning
• User logout
• Key rotation

---

10. JWT vs Session Authentication

Answer

JWT	Session
Stateless	Stateful
Scalable	Server session required
Good for APIs	Good for traditional web apps
Token stored by client	Session stored on server
Ideal for microservices	Better for monolithic applications

---

11. How is JWT used in Spring Boot?

Answer

Dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>
        spring-boot-starter-oauth2-resource-server
    </artifactId>
</dependency>

Configuration

@Bean
SecurityFilterChain security(HttpSecurity http)
throws Exception {

    http
      .authorizeHttpRequests(auth ->
            auth.anyRequest().authenticated())
      .oauth2ResourceServer(
            oauth -> oauth.jwt());

    return http.build();
}

Spring Security automatically validates JWT signatures and claims.

---

12. What are Enterprise JWT Use Cases?

Answer

JWT is widely used in:

• OAuth2
• OpenID Connect
• Google Login
• Microsoft Login
• Banking APIs
• Mobile Applications
• API Gateway Authentication
• Kubernetes Ingress
• Microservices
• Service Mesh

Architecture

User

↓

Identity Provider

↓

JWT

↓

API Gateway

↓

Microservices

---

13. What are Common JWT Mistakes?

Answer

Common mistakes include:

• Missing expiration
• Logging JWTs
• Using weak secrets
• Not validating issuer
• Not validating audience
• Accepting unsigned tokens
• Using HTTP instead of HTTPS
• Storing tokens insecurely
• Trusting client-side validation
• Very long expiration times

---

14. What are JWT Best Practices?

Answer

Recommended practices:

• Always use HTTPS
• Keep tokens short-lived
• Use RS256 or ES256
• Validate all standard claims
• Rotate signing keys
• Protect private keys
• Store Refresh Tokens securely
• Never expose secrets
• Implement Refresh Token rotation
• Monitor failed validations

---

15. How Does JWT Work in Enterprise Architecture?

Answer

                Users
                  │
                  ▼
         Web / Mobile Apps
                  │
                  ▼
       Identity Provider (OAuth2/OIDC)
                  │
        Access Token (JWT)
                  │
                  ▼
             API Gateway
                  │
         JWT Signature Validation
                  │
                  ▼
           Microservices Cluster
                  │
                  ▼
             Database Layer

Enterprise Components

• Identity Provider
• Authorization Server
• API Gateway
• Resource Server
• JWKS Endpoint
• Monitoring
• Logging
• Secret Management

---

JWT Summary

Concept	Description
JWT	Digitally signed token
Header	Metadata
Payload	Claims
Signature	Integrity protection
Access Token	API authorization
Refresh Token	Obtain new Access Token
RS256	Recommended enterprise algorithm
Claims	User information
Spring Security	JWT validation
OAuth2	Common JWT issuer

---

Interview Tips

1. Explain that JWT is a token format, not an authentication protocol.
2. Clearly describe Header, Payload, and Signature.
3. Differentiate Access Token and Refresh Token.
4. Mention standard claims like iss, sub, aud, and exp.
5. Explain why signatures prevent token tampering.
6. Compare HS256 and RS256.
7. Discuss JWT validation steps.
8. Explain why JWTs should have short expiration times.
9. Compare JWT with session-based authentication.
10. Use enterprise examples such as API Gateways, OAuth2, OpenID Connect, and microservices.

---

Key Takeaways

• JWT is a compact, digitally signed token format defined by RFC 7519.
• A JWT consists of a Header, Payload, and Signature.
• The Signature ensures integrity and authenticity.
• Claims carry user identity and authorization information.
• JWT enables stateless authentication, making it ideal for REST APIs and microservices.
• Access Tokens authorize API requests, while Refresh Tokens obtain new Access Tokens.
• JWT validation must verify the signature, issuer, audience, expiration, and other claims.
• Enterprise applications commonly use RS256 or ES256 instead of shared-secret algorithms.
• Spring Security provides built-in support for validating JWTs in Resource Servers.
• JWT is a core technology used with OAuth2, OpenID Connect, API Gateways, cloud platforms, and modern distributed systems.