JSON Web Token (JWT) wani token ne mai matse, mai aminci ga URL, mai ƙunshe da kansa wanda yake ɗauke da claims game da mai amfani. Sabar tana sa masa hannu sau ɗaya; bayan haka za ta iya verify token ɗin a kowace buƙata ba tare da bincike na database ba — wannan ne yake sa auth bisa JWT ya zama stateless.
JWT shi ne , sassa uku da aka encode da base64url waɗanda aka haɗa da digo:
header.payload.signatureeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 ← header
.eyJzdWIiOiIxMjMiLCJleHAiOjE3MDB9 ← payload (claims)
.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1 ← signature
{ "alg": "HS256", "typ": "JWT" }.sub (subject/user id), exp (ƙarewa), iat (lokacin bayarwa), iss (mai bayarwa), tare da duk wani filin al'ada (role, email).An encode payload, ba a encrypt ba. Kowa na iya base64-decode ya karanta shi, don haka kada ka taɓa sanya kalmomin sirri ko secrets a cikin JWT.
signature = HMAC-SHA256(
base64url(header) + "." + base64url(payload),
secret
)
A kowace buƙata sabar tana sake lissafta signature a kan header+payload da aka karɓa sannan ta kwatanta shi. Idan sun yi daidai kuma exp yana nan gaba, ana amincewa da token — ba a buƙatar session store.
const jwt = require("jsonwebtoken");
const token = jwt.sign({ sub: "123", role: "admin" }, SECRET, {
expiresIn: "15m",
});
try {
const claims = jwt.verify(token, SECRET); // yana jefa kuskure idan an lalata ko ya ƙare
// claims.sub === "123"
} catch (e) {
// ƙi: mara inganci ko ya ƙare
}
Saboda verification stateless ne, ba za ka iya ɓata token kafin ya ƙare kawai ta hanyar "share" shi a gefen sabar ba. Matakan ragewa na yau da kullum:
jti) don logout/lalacewa — wannan yana dawo da ɗan state.| Ajiya | Fa'ida | Rashin amfani |
|---|---|---|
Cookie na httpOnly | JS ba zai iya karantawa ba (mai aminci ga XSS) | Yana buƙatar kariyar CSRF |
localStorage | Mai sauƙi, babu CSRF | Yana fuskantar XSS |
JWTs suna ba da ƙarfi ga authentication mai stateless a fadin APIs, microservices, da SPAs — sabis na iya amincewa da buƙata ta hanyar verify signature kaɗai, ba tare da session store na gama gari ba. Amma wannan statelessness ɗin shi ne tarko na gargajiya na hira: ba za a iya soke tokens cikin sauƙi ba, ana iya karanta payload, kuma rikicewar alg ko rashin binciken ƙarewa raunanan gaskiya ne. Sanin ainihin abin da signature yake karewa, da abin da ba ya karewa, yana da muhimmanci don amfani da JWTs cikin aminci.
Ɗakin karatu na tambayoyin hira na IT tare da amsoshi cikakke — daga Junior zuwa Senior.
Ba da Gudummawa