JWT
What JWT that?
Json web token (JWT) is a statement in order to pass between the network application execution environment JSON-based development standards (RFC7519), the token is designed to be compact and safe, especially for distributed sites of single sign-on (SSO )Scenes. JWT's statement is generally used to pass the authenticated user identity information among identity providers and service providers, in order to obtain resources from the server, you can also add some additional business logic other information necessary to declare that the token can be is directly used for authentication may be encrypted.
Log in keeping with the traditional authority interfaces is how to achieve?
- User sends the username and password to the server.
- After the server is verified, in the current session (session) which holds the relevant data, such as user roles, login time, and so on.
- Session_id a server returns to the user, the user writes Cookie.
- The user then every request will by Cookie, the session_id back to the server.
- Server receives session_id, find pre-stored data, therefore represents the user's identity.
JWT data structure
image.png
image.png
image.png
composition
image.png
JWT features
- JWT default are not encrypted, but also can be encrypted. After generating the original Token, the encryption key may be used again.
- JWT case without encryption, secret data can not be written to JWT.
- JWT not only can be used for authentication, it can also be used to exchange information. Effective use of JWT, the number of server queries the database can be reduced.
- JWT's biggest drawback is that the server does not save session state, and therefore can not be abolished in the course of a token, token or change permissions. That is, once issued JWT, will remain in effect until maturity, unless the server to deploy additional logic.
- JWT itself contains authentication information, when disclosed, anyone can get all the permissions of the token. To reduce theft, JWT's validity should be set relatively short. For some of the more important rights, should once again to authenticate the user during use.
- To reduce theft, JWT should not use the HTTP protocol transmission codes, to use the HTTPS protocol.
RBAC permissions model
Relationship based on a common model of authority
image.png
RBAC module function
image.png
RBAC access control process
image.png