JWTs: bearer tokens and validation

A JWT is signed, not encrypted. Knowing what must be checked is everything.

UnderstandStudy an examplePractise

Understand the concept

A JSON Web Token has three parts: header, payload and signature, each Base64URL-encoded and joined with dots. The payload’s claims (user id, role, expiry) are readable by anyone; the signature only proves they were not changed. Passwords or sensitive personal data therefore never go into a JWT.

Before accepting a token the server verifies: was it signed with the expected key and algorithm, are the issuer and audience the expected values, has it expired (exp). Letting the token choose its own algorithm has historically caused serious vulnerabilities; the accepted algorithm is fixed on the server.

The weak point of JWTs is revocation: a signed token stays valid until it expires. Lifetimes are therefore kept short and extra checks added where needed. In this project every JWT validation also checks the user’s security stamp; signing out changes the stamp and invalidates old tokens.

WHEN TO USE IT

A missing validation step means anyone can mint their own token.

COMMON PITFALL

Decoding the token from Base64 and reading claims without verifying the signature.

LIVE ANIMATION

A letter’s journey through the city

Think of a request as a letter and the server as a city. Pick a scenario, press play and watch which gates the letter passes and where it gets stopped.

OUTBOUND →

You sent the sign-in form. Your password travels inside the encrypted tunnel, never in the address bar.

BrowserYour screen. It writes the request and finally turns the answer into a page.

1 / 12

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiI3YzFlIiwicm9sZSI6IkFkbWluIiwiZXhwIjoxNzkxMzgwMDAwfQ . 4kd…
     header                         payload (herkes okuyabilir)                         imza

The payload is not encrypted; it is only protected by the signature.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

An attacker changes the role in the payload from ‘User’ to ‘Admin’, re-encodes the token and sends it. What does a correctly configured API do?

Show the solution and explanation

Worked solution

İmza artık payload ile eşleşmez → doğrulama başarısız → 401.
Saldırgan anahtarı bilmeden geçerli imza üretemez.
(alg: "none" denemesi de ValidAlgorithms ile reddedilir.)

JWT security comes from verifying the signature, not from hiding the payload.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.