srl
JSON Web Tokens (JWTs)
JSON Web Token (JWT) is a format for transmitting cryptographically secure data, typically used as a stateless session token. The server verifies the token’s signature and then retrieves user information from the JWT claims.
A JWT has three base64url-encoded parts separated by dots:
<Base64_Header>.<Base64_Payload>.<Base64_Signature> Header — metadata, including the signing alg (algorithm) and optional key identifiers (kid, jwk, jku). Payload — the claims (registered and custom). Signature — computed over the header and payload using a key, per the algorithm in the header. If any part of the header or payload is modified, the signature no longer matches — unless the server’s verification logic is flawed. That is what every attack in this file targets: not the cryptography, but the verification code path.