Should jwt web token be encrypted?

前端 未结 3 2176
野性不改
野性不改 2020-12-06 09:49

I was reading article on JWT web token as an access token that is being response to the user. Some of it mention that the web token should be able to be decoded by the user.

3条回答
  •  孤城傲影
    2020-12-06 09:58

    JWT are "signed" and therefore its contents are protected from tampering: you cannot change its contents without invalidating them.

    You can optionally "encrypt" the contents and therefore turn them visible only to issuer (the entity creating the token) and the consumer (the entity that is destined to use its contents after verification).

    There's a standard for that: JWE

提交回复
热议问题