Documentazione

Impara cos'è JWT e come usarlo nelle tue applicazioni.

Cos'è JWT?

JSON Web Token (JWT) è uno standard aperto (RFC 7519) per la trasmissione sicura di informazioni tra parti come oggetto JSON.

Struttura JWT

Un JWT è composto da tre parti separate da punti: Header.Payload.Signature.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header

Contiene metadati sul token: algoritmo (alg) e tipo (typ).

Payload

Contiene le claims (dichiarazioni) su un'entità e metadati aggiuntivi.

Firma

Verifica che il token non sia stato alterato.

Claims Comuni

iss (Issuer): identifica chi ha emesso il token

sub (Subject): identifica il soggetto del token

aud (Audience): identifica i destinatari del token

exp (Expiration): tempo di scadenza (timestamp Unix)

nbf (Not Before): tempo prima del quale il token non deve essere accettato

iat (Issued At): momento in cui è stato emesso

Algoritmi Supportati

JWT supporta vari algoritmi di firma.

HS256 / HS384 / HS512

HMAC con SHA-2 — firma simmetrica

RS256 / RS384 / RS512

RSA con SHA-2 — firma asimmetrica

ES256 / ES384 / ES512

ECDSA con SHA-2 — firma asimmetrica a curva ellittica

EdDSA (Ed25519)

EdDSA — firma moderna a curva ellittica con Ed25519

Esempi di Codice

Frammenti di codice pronti per JWT in vari linguaggi.

JavaScript (Node.js)

const jwt = require('jsonwebtoken');

// Sign
const token = jwt.sign(
  { sub: '1234567890', name: 'John Doe' },
  'your-secret-key',
  { algorithm: 'HS256', expiresIn: '1h' }
);

// Verify
const decoded = jwt.verify(token, 'your-secret-key');
console.log(decoded);

TypeScript (jose)

import { SignJWT, jwtVerify } from 'jose';

// Sign
const secret = new TextEncoder().encode('your-secret-key');
const token = await new SignJWT({ sub: '1234567890', name: 'John Doe' })
  .setProtectedHeader({ alg: 'HS256' })
  .setExpirationTime('1h')
  .sign(secret);

// Verify
const { payload } = await jwtVerify(token, secret);
console.log(payload);

Python

import jwt

# Sign
token = jwt.encode(
    {"sub": "1234567890", "name": "John Doe"},
    "your-secret-key",
    algorithm="HS256"
)

# Verify
decoded = jwt.decode(token, "your-secret-key", algorithms=["HS256"])
print(decoded)

Java

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

// Sign
String token = Jwts.builder()
    .setSubject("1234567890")
    .claim("name", "John Doe")
    .signWith(SignatureAlgorithm.HS256, "your-secret-key")
    .compact();

// Verify
Claims claims = Jwts.parser()
    .setSigningKey("your-secret-key")
    .parseClaimsJws(token)
    .getBody();

import (
    "github.com/golang-jwt/jwt/v5"
)

// Sign
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
    "sub":  "1234567890",
    "name": "John Doe",
})
tokenString, err := token.SignedString([]byte("your-secret-key"))

// Verify
parsed, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
    return []byte("your-secret-key"), nil
})
claims := parsed.Claims.(jwt.MapClaims)

Ruby

require 'jwt'

payload = { sub: '1234567890', name: 'John Doe' }

# Sign
token = JWT.encode(payload, 'your-secret-key', 'HS256')

# Verify
decoded = JWT.decode(token, 'your-secret-key', true, algorithm: 'HS256')
puts decoded[0]

PHP

use Firebase\JWT\JWT;

$payload = [
    'sub' => '1234567890',
    'name' => 'John Doe',
];

// Sign
$token = JWT::encode($payload, 'your-secret-key', 'HS256');

// Verify
$decoded = JWT::decode($token, new Key('your-secret-key', 'HS256'));
print_r($decoded);

Rust

use jsonwebtoken::{encode, decode, Header, Algorithm, Validation, EncodingKey, DecodingKey};

// Sign
let token = encode(
    &Header::new(Algorithm::HS256),
    &serde_json::json!({"sub": "1234567890", "name": "John Doe"}),
    &EncodingKey::from_secret("your-secret-key".as_ref()),
)?;

// Verify
let token_data = decode::<serde_json::Value>(
    &token,
    &DecodingKey::from_secret("your-secret-key".as_ref()),
    &Validation::new(Algorithm::HS256),
)?;

C# (.NET)

using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var securityKey = new SymmetricSecurityKey(
    Encoding.UTF8.GetBytes("your-secret-key"));

// Sign
var token = new JwtSecurityToken(
    claims: new[] { new Claim("sub", "1234567890"), new Claim("name", "John Doe") },
    signingCredentials: new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256)
);
var tokenString = new JwtSecurityTokenHandler().WriteToken(token);

// Verify
var principal = new JwtSecurityTokenHandler().ValidateToken(tokenString,
    new TokenValidationParameters { ValidateIssuerSigningKey = true,
        IssuerSigningKey = securityKey, ValidateIssuer = false, ValidateAudience = false },
    out _);

Swift

import JWT

// Sign
let payload = JWTPayload(sub: "1234567890", name: "John Doe")
let signer = JWTSigner.hs256(key: Data("your-secret-key".utf8))
let token = try signer.sign(payload)

// Verify
let verifier = JWTVerifier.hs256(key: Data("your-secret-key".utf8))
let verified = try verifier.verify(token)