Fundamentals of Secure Software - JWT (JSON Web Token)

The video tutorial explains JSON Web Tokens (JWTs), an open standard for securely transmitting information between parties as a JSON object. JWTs can be signed using a secret or public/private key pair, ensuring the integrity and authenticity of the claims. They are commonly used for authorization, allowing users to access resources without maintaining a session on the server. The structure of a JWT includes a header, payload, and signature, with claims that can be registered, public, or private. The tutorial also covers the process of creating and verifying JWTs, emphasizing the importance of not including sensitive information unless encrypted.

What is the primary purpose of a JSON Web Token?

• To store user preferences

• To securely transmit information between parties

• To encrypt files on a server

• To manage database connections

How do JSON Web Tokens differ from traditional session-based authentication?

• JWTs are stored on the server

• JWTs require a database lookup for each request

• JWTs are stateless and do not require server memory

• JWTs cannot be used for authorization

What are the three main components of a JSON Web Token?

• Header, Payload, Signature

• Header, Body, Footer

• Payload, Signature, Footer

• Header, Body, Signature

Which type of claim in a JWT is predefined but not mandatory?

• Public claims

• Private claims

• Custom claims

• Registered claims

What should you avoid including in the payload of a JWT unless it is encrypted?

• User preferences

• Registered claims

• Sensitive information

• Public claims

How is the signature of a JWT used?

• To manage session state

• To store user roles

• To verify the message wasn't altered

• To encrypt the payload

What encoding is used for the JWT header and payload?

• Hexadecimal encoding

• ASCII encoding

• UTF-8 encoding

• Base64 URL encoding