Skip to content

Commit b74c3ba

Browse files
committed
Added link to landing and added temporary fix for snippets
1 parent c4141d4 commit b74c3ba

File tree

1 file changed

+10
-13
lines changed

1 file changed

+10
-13
lines changed

views/md/introduction.md

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,12 @@ The header *typically* consists of two parts: the type of the token, which is JW
3333

3434
For example:
3535

36-
```js
36+
``
3737
{
3838
"alg": "HS256",
3939
"typ": "JWT"
4040
}
41-
42-
```
41+
``
4342

4443
Then, this JSON is **Base64Url** encoded to form the first part of the JWT.
4544

@@ -58,14 +57,13 @@ There are three types of claims: *reserved*, *public*, and *private* claims.
5857

5958
An example of payload could be:
6059

61-
```js
60+
``
6261
{
6362
"sub": "1234567890",
6463
"name": "John Doe",
6564
"admin": true
6665
}
67-
68-
```
66+
``
6967

7068
The payload is then **Base64Url** encoded to form the second part of the JSON Web Token.
7169

@@ -74,12 +72,12 @@ To create the signature part you have to take the encoded header, the encoded pa
7472

7573
For example if you want to use the HMAC SHA256 algorithm, the signature will be created in the following way.
7674

77-
```js
75+
``
7876
HMACSHA256(
7977
base64UrlEncode(header) + "." +
8078
base64UrlEncode(payload),
8179
secret)
82-
```
80+
``
8381

8482
The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message was't changed in the way.
8583

@@ -99,7 +97,9 @@ In authentication, when the user successfully logs in using his credentials, a J
9997

10098
Whenever the user wants to access a protected route or resource, it should send the JWT, typically in the **Authorization** header using the **Bearer** schema. Therefore the content of the header should look like the following.
10199

102-
`Authorization: Bearer <token>`
100+
``
101+
Authorization: Bearer <token>
102+
``
103103

104104
This is a stateless authentication mechanism as the user state is never saved in the server memory.
105105
The server's protected routes will check for a valid JWT in the Authorization header, and if there is, the user will be allowed. As JWTs are self-contained, all the necessary information is there, reducing the need of going back and forward to the database.
@@ -125,8 +125,5 @@ Regarding usage, JWT is used at an Internet scale. This highlights the ease of c
125125
![Comparing the length of an encoded JWT and an encoded SAML](https://cdn.auth0.com/content/jwt/comparing-jwt-vs-saml2.png)
126126
_Comparison of the length of an encoded JWT and an encoded SAML_
127127

128-
##How we use JSON Web Tokens in Auth0?
129-
130-
In Auth0, we issue JWTs as a result of the authentication process. When the user logs in using Auth0, a JWT is created, signed, and sent to the user. Auth0 supports signing JWT with both HMAC and RSA algorithms. This token will be then used to authenticate and authorize with APIs which will grant access to their protected routes and resources.
131128

132-
We also use JWTs to perform authentication and authorization in Auth0's API v2, replacing the traditional usage of regular opaque API keys. Regarding authorization, JSON Web Tokens allow granular security, that is the ability to specify a particular set of permissions in the token, which improves debuggability.
129+
If you want to read more about JSON Web Tokens browse to the [JSON Web Token landing page](auth0.com/learn/json-web-tokens) in Auth0.

0 commit comments

Comments
 (0)