JSON Web Token

JSON Web Token (JWT) is a JSON-based open standard for passing claims between parties in web application environment. The tokens are designed to be URL-safe and usable especially in web browser single sign-on (SSO) scenarios. JWT claims can be typically used to pass identity of authenticated users between an identity provider and a service provider, or any other type of claims as required by business processes. The tokens can also be authenticated and encrypted.

Structure

The following example token, issued by Identity Provider, states that John Doe is an administrator:

{ "iss": "Identity Provider", "name": "John Doe", "admin": true }

A claim can be sent with a authentication header, declaring a cryptographic message authentication code (HMAC with SHA256 in the following example):

{ "typ":"JWT", "alg":"HS256" }

After canonicalization both structures is encoded as BASE64 and the declared message authentication code is calculated over the encoded string. The output is three BASE64 strings separated by dots that can be easily passed in HTML and HTTP environments, while being more compact compared to XML-based standards such as SAML.