JWT and the JOSE Family

JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and stateless authorization. JWT is the most-used member of the JOSE family (JavaScript Object Signing and Encryption): JWS, JWE, JWK, JWA. Most “JWTs” you’ll see are signed (JWS); encrypted (JWE) is rarer.

For security pitfalls (the most-tested angle), see ../../25_security/06_jwt_pitfalls.md. For SSO and OIDC context: ../sso/ and ../../25_security/05_oauth2_oidc.md.

Files

#	Topic
01	JWT basics — structure and encoding
02	Signing algorithms — HS/RS/ES, alg attacks
03	Claims — registered, public, private
04	Access and refresh tokens
05	Revocation and logout
06	Python implementation with PyJWT
07	JWT vs session-based auth
08	JOSE family — JWS, JWE, JWK, JWA

../01_authentication_overview.md — auth fundamentals
../sso/03_tokens_id_access_refresh.md — ID vs access vs refresh in OIDC
../../07_rest_apis/02_jwt_auth.md — JWT in REST APIs
../../25_security/06_jwt_pitfalls.md — security pitfalls
../../25_security/05_oauth2_oidc.md — OAuth 2.0 / OIDC context