JWT Token Issue

Question

I created a jwt token using java keystore public key an and io.jsonwebtoken library. After generation i copy pasted the generated token in https://jwt.io website. It decoded my token without using private key.How come this is possible?

KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
PrivateKey privateKey = pair.getPrivate();
Claims claims = Jwts.claims().setSubject(userName);
        claims.put("scopes", scopes);
        String token = Jwts.builder()
                .setClaims(claims)
                .signWith(SignatureAlgorithm.RS256, privateKey)
                .compact();

jwt payload is base64 encoded. Your private key is used to sign the jwt. — Iurii Drozdov
Possible duplicate of If you can decode JWT how are they secure? — jps
@All: How to encrpty the jwt token then? Is there any mechanism whihc jwt lib provides ? — user1001
if you really need encryption, look into JWE (encrypted JWT): tools.ietf.org/html/rfc7516 — jps

Tim Biegeleisen Tim Biegeleisen · Accepted Answer · 2019-10-22T08:48:21

Your JWT is only signed, not encrypted. The main security feature of the incoming JWT is that it has a checksum/signature at the end. Your Java program has the ability to verify that the checksum matches the actual content of the JWT (e.g. headers and claims). If the checksum does not match, then the server will assume the JWT has been tampered with and reject it. The main use of a JWT is not so much protecting critical information as it is about controlling authorization and authentication in your application.

JWT Token Issue

1 Answers