[JWT] JWT with HS256

The advantages of JWT over traditional session based validation is:

it effectively removing all authentication logic from both our codebase and our database, and delegating it to a third-party service

In this post, we are going to see, how to create and verify HS256 JWT token.

Main idea behind HS256 JWT token is both Receiver and Producer should have the 'secret key'.

Create:

var jwt = require('jsonwebtoken');

var secretKey = 'secret-key';

var payload = {
  name: 'Alice'
};

// create a JWT
var newToken = jwt.sign(payload, secretKey, {
  algorithm: 'HS256'
});

console.log('JWT created:', newToken);

Verifiy:

var jwt = require('jsonwebtoken');

// verify an existing JWT
var existingToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiQWxpY2UiLCJpYXQiOjE1MDI4ODkxOTF9._tPQtlZz2GhXHXATn5W09K4XCG0Z5LyEQqikJf3qXF8';

var secretKey = 'secret-key';

const verify = jwt.verify(existingToken, secretKey);

console.log('Decoded JWT:', verify);

As long as it pass the verification, we can ensure that the user is authed.