JSON Web Token

JWT is introduced on https://en.wikipedia.org/wiki/JSON_Web_Token as follows:

JSON Web Token (JWT) is a proposed Internet standard for creating data with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims. The tokens are signed either using a private secret or a public/private key.

The JWT is sent in the HTTP Header Authorization. An example looks like this:

Authorization
    Bearer eyJhbGciOiJSUzI1NiJ9.eyJwcmluY2lwYWwiOiJmMTY3ODNjMy1jYjBjLTM3MjctOTVjMS0wNzUyZjkzOGY3YTciLCJwcmluY2lwYWxOYW1lIjoiYWRtaW4iLCJleHBpcmVzIjoxNzIxNzQzODExNzc0LCJzZXNzaW9uIjoiMjEzZDc1NjAtMDQ0MS00ZDQ0LWE3N2EtOWFmNzQ0YjNhZDBhIiwibGFuZyI6ImRlIiwiYWNjb3VudHMiOnsiODk3ZDMwNTMtYzQzMy00OTMzLWJiMzQtOTVhZjI1MjM4NjBlIjp7Im93bmVyIjp0cnVlLCJyb2xlIjoiYWRtaW4iLCJ0eXBlIjoiUFJPSkVDVCJ9fX0.TErlEo0zhfM8hkAK-88F_RqfOLOsQaFBeryew1duFkuDe4z_LsYjpYwNq5woLcTWp4sRY7cWk6yTEZhOgTNghOpHEw1pla2iyo9LcGwu9AVRH0MAX5Yl_z6-fwE6PG_k3lkwu22gk5gvmeqJPO7lp9mjUp4VEm5Qd40NP0VpccXt5STrnFE0NUUj6BmZcNpbY1gd9t3MNakuqN6E7FQvFe7eCKYY0WdhFhYCeuyPandN6V9Lx1Jp_482KXVP3bEMRECN5BW31pprR2wGQWciJyuos4bHDaikCxXns4YEmnFNdTGrKON0RHpGwiQDADGCWMz8S4ZH_9LjCgU3ZW43XC4vDD5uR715mHvJPT4kfGCMMRZa1R3jno2FhsWcDFwDwwpANGUzsgIW8wfup8hVLI6FfL93lJe2nlxThn-GDPzlwRG1uL4_4GqC2sJ2ltR8jAHi1471d74SW2xvlQMZhR-vSpjHhck6dnmJP6v3ZyPKaY6uHCpw9BCYyq92x3A2

The token can be decoded with the JWT debugger at https://jwt.io:

// header
{
    "alg": "RS256"
}
// payload:
{
    "principal": "f16783c3-cb0c-3727-95c1-0752f938f7a7",
    "principalName": "admin",
    "expires": 1721743811774,
    "session": "213d7560-0441-4d44-a77a-9af744b3ad0a",
    "lang": "de",
    "accounts": {
        "897d3053-c433-4933-bb34-95af2523860e": {
            "owner": true,
            "role": "admin",
            "type": "PROJECT"
        }
    }
}
// signature:
// N/A

This, means the given JWT is for the user admin, valid in the account with the UUID 897d3053-c433-4933-bb34-95af2523860e, login in with the role admin.

This token is sent with each API request, so that the respective micro service can authorize the request.

The token is obtained by authenticating and then authorizing against the authentication microservice.

Obtaining a temporary JWT

Within your browser's debugger, select any request after logging in. Open the Headers tab and scroll all the way to the bottom to the section Request Headers. The attribute Authorization contains the JWT: