If I can decode a JWT, then how are they secure?
-
FusionAuth issues a lot of JWTs. But since I can grab any JWT from the browser and decode it using a JWT debugger, how could this be considered secure?
-
Good question.
JWTs are either signed or encrypted. For the most part, you will encounter signed JWTs. When a JWT is created by an authorization server, it is signed. The signature essentially functions as a way to say "this payload has been signed using this algorithm. If the payload is different than what was signed, then this JWT is invalid." It is important to not pass sensitive data in a JWT payload for the reason that it can be viewed, but if a malicious actor tries to tamper with the JWT, the signature will no longer match it, and it will be invalid.