jwt(json web token)

effect

jwt Can be used for cross domain authentication

constitute

brief introduction

1. jwt Full name json web token
2. jwt from header.payload.signature form

constitute /header

{
    
	"alg": "HS256",
	"typ": "JWT"
}

constitute /payload

Common load ： Optional

• iss（issue JWT Issued by ）
• aud（auditor JWT The receiver ）
• sub（subject, The theme ）
• iat(issued at, The issuance of time )
• exp（expire, Due time ）
• uid（ user ID）
• username（ user name ）
• scopes（ Scope of Authorization ）

{
     
 "iat": 1593955943, 
 "exp": 1593955973, 
 "uid": 10, 
 "username": "test", 
 "scopes": [ "admin", "user" ] 
}

constitute /signature

// header, Algorithm pairs specified in JWT To sign ,secret Secret key 
// secret, Encryption algorithm secret key 
signature=HMACSHA256(base64UrlEncode(header) + "." +base64UrlEncode(payload),secret)

technological process

Be careful ：

• token Use after expiration refresh_token
• refresh_token Not expired will only generate new token, Will not generate refresh_token
• refresh_token After expiration, you can only log in again
• You can just use token Do not apply refresh_token