In this video we're going to get a better understanding of what a Jason Webb token is.
A Jason Webb token is a string that proves that a user is who they say they are.
Now just understanding that without any further explanation is a little bit challenging.
So I want to first give you a quick analogy to help you understand why we're using a Jason Webb token
and what its real goal is.
So here's a quick analogy I want to consider what a driver's license in the United States does.
Just so you know in the United States a driver's license is a small card a plastic card that has some
identifying information about a person a driver's license is not used only to prove that you can drive
a vehicle.
But it's also used as a form of identification.
So for example if you go to a bank and you need to prove that you are who you say you are that you can
access your bank account the bank might ask you for your driver's license.
They will then look at the driver's license look at your picture look at you and look at the name on
the card as well and say OK.
Clearly you are who you say you are.
And then you can get access to your bank account.
So I want examined some of different qualities that a driver's license has.
So first off a driver's license can be used to prove that you are who you say you are.
It has some identifying information about the person carrying the I.D. such as a picture a address a
name and so on.
Very critically the I.D. itself like that plastic card has some security measures to prove that it is
a very real I.D. And it's not somehow produced maliciously or produced or edited or manipulated or something
like that.
In particular a driver's license in the state of California has some holograms on it.
It also has a kind of hard to print little small picture of the person holding the card right there
the signature over here on the left hand side.
That's also kind of like raised lettering.
So if you run your finger over it you can feel that lettering.
And so all these different kind of special security features are really hard to fake.
It is possible to fake you know you can't of course change the name of a card and you might be to pass
it off as a real card.
By the end of the day it is kind of hard to manufacturer a driver's license or make changes to an existing
one.
And it is those properties that allow us to use a driver's license as a somewhat secure form of identification.
It's why you can use it to get access to say a bank account so at the end of the day when we make use
of a driver's license we're taking some identifying information about a person and we are encoding it
onto a plastic card and that card is really hard to produce.
And it's very hard to modify and because of those different properties we can safely use it or you know
kind of reasonably safely use it as a form of identification so a Jason web token is very similar to
a driver's license with a Jason web token.
We have a string that carry some identifying information.
If you have this string like if a user has this string then we can use it to prove that that user is
who they say they are a Jason web token is it created using a special key or essentially a string of
characters that only our server knows and because of that because only our server has that key.
It is impossible to create a new Jason web token that will work with our server.
And it's also very challenging or impossible to make changes to an existing Jason web token.
So again at Jason web token very similar to a driver's license it carries some information about a very
specific person.
And it's really hard to change or fake information inside there.
Now to get a better idea of what a Jason web token is we're going to take a look at a little tool very
quickly.
You can open up a new browser tab and navigate to JWT dot Io okay.
So once here we're going to scroll down a little bit and find this section right here.
So the section inside of here that you and I really care about is this payload section the payload section
represents some amount of data that we want to encode inside of our Jason web token.
So if we were working with a driver's license the payload of a driver's license would really be like
the name address and picture.
It has some identifying information about the user.
And that's what we can use that payload section right there for as well so inside of our application
inside of our payload we're going to instead of placing all that information we're going to place the
user I.D. of a particular user our user I.D. that we put inside of here is going to be the same I.D.
that is assigned to a user record when it is created inside of our Mongo DB database.
So here's my Mongo database.
I have a I.D. property that was automatically generated for my user by Mongo.
So that I.D. right there is unique to this user account the user account with that given email and that
given password so we're gonna take that I.D. and stored inside of art payload property like so so the
result of that is this Jason web token.
This is the token right here on the left hand side.
This stuff in purple is the encoded information so we can take this string right here.
We can exchange it around and we can use this as some form of ID the information inside this token can
be freely read by anybody.
So this information right here anybody can take this token decode the information and see that user
I.D. inside there but very critically no one can make changes to the token.
So if anyone tries to change the information inside there we're going to know instantly.
So it's very hard to modify an existing token or create a new one from scratch.
So by just having this string of characters right here we can use it to prove that a user is who they
say they are OK down here inside a verify signature.
You'll also notice that there's something that called Your 255 or 256 bit secret so that's where we're
going to put some little secret token that is unique to our server.
And again that's what's going to make sure that nobody else can make a modification or a change to an
existing token.
All right.
So we're going to use this entire system right here to make sure that a user is who they say they are.
As we saw back in this diagram over here after a user signs in we're going to generate a Jason web token.
And inside there we're going gonna put the user's I.D. We're then going to send that Jason web token
back to the user's device and then we're going to require that that user includes that Jason Web token
with any follow up request when the request is made to our API.
We're going to take a look at that token.
We're going to take a look at the user I.D. inside there and we're gonna say OK it looks like you are
the user with I.D. so and so and so we will know exactly who is making that request.
Now once again on repeat one last time because this is the really important thing that really trips
people up you can not easily make changes to an existing Jason web token.
The information site there is easily visible anyone with a token can see what that user ideas but you
can't change it without that key.
So as long as Aki is secret and we don't provide it with the outside world we can always trust that
a Jason web token and the key or the information inside there is 100 percent legitimate.
Very similar to a driver's license.
It's really hard to change information inside that token.
Okay so now that we've got a better idea of what a Jason Webb token is let's make sure that we produce
one after user signs and then we'll send it back to them and they can use it to make some follow up
request.
So quick pause and I'll see you in just a minute.