In the last video we were able to sign up for the very poor sign and get back a Jason Webb token.
Now this right here is not exactly a Jason Webb token but it does kind of technically contain it.
The value that we're actually looking at is that session object that we just set.
So in other words this session object right here.
They got turned into Jason and then base64 encoded so to actually get the Jason Webb token out of here.
Got to do just a little bit of work.
Well let's go through just one time just to make sure it's all crystal clear so I can take that value
right there.
I'm going to copy it and then going to go over to my browser and I'm going to go to a Web site called
base 60 for decode dot org.
This is a little tool that can take a base 64 string and then plate reader see me decode it into plain
UTF 8 so paste in that whole string I'll hit DECODE AND THERE IT IS OUR Jason object right there you'll
see that we do have in fact that JWT property and inside that string that is the actual honest to God
Jason web token let's play round with that string a little bit too.
I'm going to take just the Jason Webb token I'm going to copy it and I'll go to yet another Web site
called JWT dot Io This is a Web site just to help raise awareness of Jason Webb tokens and how they
work if you come to JWT to IO and then scroll down a little bit there's a little tool that you can use
to take a look at.
Jason what tokens and just make sure that they are actually properly encoded see the information side
them and all that stuff so going to take the Jason Webb token and put it in on the left hand side then
go to the right hand side and down here inside a verified signature.
We're going to put in the signing key that we wrote into our code just a moment ago.
So for me it was simply a SDF don't put in right here SDF.
As soon as I do so you'll see that says signature verified.
So that is the proof that this is a valid token.
If some malicious user came along and tried to change the information side of here.
So let's say they changed essentially anything inside of here.
So I'm going to go ahead delete a character all of sudden it is no longer a valid token.
We tried to we tried to verify that this was a valid token using that signing signature of a SDF and
note it failed to check which would be assigned to you and I as developers that someone has messed around
with this thing and we should no longer trust it as soon as I put in the valid token once again the
whole thing is valid you'll notice it on the right hand side.
We cannot see the payload inside of here very easily just you know you can see this payload even if
we have a invalid token or you don't need that signing that signing string right there we can delete
that entirely and we can still see all the information inside this payload just fine.
Remember with the Jason Webb token anyone can see the information inside of it and it is the fact that
we can verify that no one has messed around with this information that actually makes it significant.
We can see the I.D. of the user.
We can see their email and then IATA right here is the issued at time that's when the Jason Webb token
was actually created.
So that all looks pretty good now.
Quick diagram this want to expand on that signing key it just a little bit.
So we took the payload we took these signing key and we tossed them into our Jason Webb token library
and that spat out our actual Jason Webb token any time that we are going to receive this Jason Webb
token inside of another service when we need to see whether or not it is a valid token to decide whether
or not this user is actually logged in.
That means that those other services are going to need to get access to that signing key is it's only
with that signing key that we can make sure that a token is actually valid.
Now the downside here we're essentially talking about sharing this signing key with all these other
services if anyone ever got access to that signing key they could easily manufacture their own tokens
that our application would think are valid.
So we essentially need to share the signing key with all of our other services but we need to make sure
that no one else gets their hands on it.
So as you'd guess writing out that signing key in plain text as we are doing right here is not appropriate
at all.
At no point time unless we are in a development environment just messing around a little bit do we want
to write out that signing key in plain text.
So we need to figure out some way to extract that signing key store it securely somehow within our overall
application and we need to make sure that we can easily share that exact signing key with everything
inside of our app.
So all the other different services that are going to eventually receive a Jason web token so this really
comes down to a challenge with Docker and Cuban settings.
Let's take a pause right here.
When come back the next video we're going gonna figure out how we can securely share information about
all of our different services.