jwt signature and validation explained

[@malam3958]

It was very helpful. thank you.

[@sathishmanjavo]

Nice one🎉 thanks for the video.

[@learningsoftwareskills]

Thanks for the encouraging feedback👍

[@binarasachin5104]

One of the best explanations I found about JWT in the internet. Thank you for the video

[@learningsoftwareskills]

Thanks a lot for the amazing feedback 👍🙏

[@adityapandey2514]

i second that

[@suraj_fusion]

One of the best explanations thank you..

[@learningsoftwareskills]

Thank you for the amazing feedback 👍🙏

[@rryann088]

excellent! Thank you so much!!!

[@learningsoftwareskills]

@@rryann088 thank you for the amazing feedback 👍🙏

[@SoyJavero]

Best explaination ever, very concise :D

[@learningsoftwareskills]

@@SoyJavero thank you 🙏👍

[@amolnagrale9628]

Very nice explanation 😃 kudos👏 first I understand deeply

[@learningsoftwareskills]

Thank you very much 🙏👍

[@user-of9qp8bj8o]

Good Explanation

[@learningsoftwareskills]

Thank you very much 👍

[@srilakshmi7040]

Really very good explanation. It helped me to understand what JWT is and how it works. Thanks a lot

[@learningsoftwareskills]

You are welcome 🙏👍

[@anirudh514]

Very well explained!! Thanks

[@learningsoftwareskills]

I am glad you liked it 👍

[@suyashbansod729]

Too good explanation... Keep up the good work!!!!!

[@learningsoftwareskills]

Thank you 🙏👍

[@SaminYasir-f3m]

Excellent Video on JWT token validation! Keep the good work going!

[@learningsoftwareskills]

Thank you👍🙏

[@yuvarajanbazhagan]

Really detailed explanation about JWT.
Thank you for this video!

[@learningsoftwareskills]

Hi, Glad you liked it! Thanks 🙏😊

[@brunobkpzica4598]

Thank you. I wish i had seen this video before a job interview i had last week.

[@learningsoftwareskills]

Thank you very much for ur amazing feedback 👍🙏

[@SoyJavero]

next time you'll get it right :D

[@qasimhussain7176]

Too good sir, really helpful, may god bless u

[@learningsoftwareskills]

Thank you 👍🙏

[@rahuljuneja6015]

excellent and precise, thank you

[@learningsoftwareskills]

You are welcome 👍🙏

[@shanthiyarajan5233]

Perfect explanation, thanks

[@learningsoftwareskills]

Thank you for the amazing feedback 👍🙏

[@bonammadankumar681]

Awesome explanation buddy

[@learningsoftwareskills]

Thanks buddy

[@KiranRaj-q2e]

superb explanation

[@learningsoftwareskills]

Thank you 🙏

[@shraddhapaliwal4817]

Very well explained

[@learningsoftwareskills]

Thank you 🙏👍

[@sanketsakharkar1164]

Hello,
Thank you for the detailed explanation; it is really helpful!
I have a question: how does the receiver decrypt the message if only the server has the private key?

[@learningsoftwareskills]

Hi, server encrypts the signature using the private key. Receiver decrypts the signature using the public key.
Any one can decrypt a signature, but only server can encrypt a signature.
Hope this helps, cheers 👍🙏

[@sanketsakharkar1164]

​@@learningsoftwareskills Thank you for your input! However, I think there might be a misunderstanding. In public key cryptography, the public key is used for encryption, while the private key is used for decryption. When it comes to signatures, the server creates the signature by encrypting it with its private key, and the receiver can verify it using the server's public key. This ensures authenticity. Let me know if you'd like to discuss it further! Cheers! 👍

[@Mayank-pk2oj]

Precise

[@learningsoftwareskills]

@@Mayank-pk2oj thank you 👍🙏

[@adityathakur3748]

Great explanation.
I have a question does the public key should be present in the JWT, or it should be already be present on the client side for verification.

[@learningsoftwareskills]

Hi, public key should be present in jwt. This is required for validating the hash
Hope this helps, cheers 👍

[@brunobkpzica4598]

@@learningsoftwareskills I think you didn't understand his question. The client should fetch the public key from the authentication server. If the public key came in the JWT, someone could tamper the JWT by replacing the public key with a new one. AWS Cognito for example provides a URL where the public key can be obtained.

[@learningsoftwareskills]

@@brunobkpzica4598 hi, you are right. I was wrong about the public key. The public key should be fetched from the server. Thanks 👍

[@learningsoftwareskills]

@@adityathakur3748 sorry the reply was wrong. The public key should be fetched from the issuing server for validating the signature.

[@SoyJavero]

@@brunobkpzica4598 oooh nice recommendation for aws cognito, ill use it for fetching a certificate x509, as far as i know this is more secure than public key because theres a more specific way to validate the token with a issuer and subject info and also with expiration, since public key does have these features