4 ms·
What’s the difference between a Bearer Token and JWT? I thought they were related?
by tixocloud 8y ago
What’s the difference between a Bearer Token and JWT? I thought they were related?
- nine_k 8y agoJWT in particular uses cryptography to encode a timestamp and some other parameters. This way, you can check if it's valid by just decrypting it, without hitting a DB. Not all bearer tokens have this property.
- luhn 8y agoA bearer token is opaque. It could be a JWT, it could be something else, depending on the application.
- geezerjay 8y agoIn essence, a JSON Web Token (JWT) is a bearer token. It's a particular implementation which has been specified and standardised.
- beckler 8y agoA bit of misinformation in this side thread. A JWT token is composed of three parts: a header, payload, and signature. The problem is that people can put sensitive info in the payload. None of it is encrypted, it's only signed with HMAC. Unless you're keeping track of the tokens, once a token is issued it's valid until it expires, due to it's stateless nature. You can use a JWT as a Bearer token, but since it's only base64 encoded, you can pull out that payload data. A truly opaque Bearer token will be meaningless to anything other than your server. Play with the debugger here to see what I'm talking about: https://jwt.io/ https://jwt.io/