SPRING CONCEPTS
JWT · JSON Web Token
Spring Concepts / JWT · JSON Web Token
A JWT contains claims and, in this app, a signature that protects their integrity.
Understand the idea
The header identifies signing details. The payload contains claims such as sub (user id), iss (issuer), aud (audience), and exp (expiration). The backend must validate signature and required claims. A signed payload is readable; it is not encrypted.
A concrete example
header.payload.signature
Authorization: Bearer ACCESS_TOKENIn the application
AuthController signs a 15-minute HS256 token. SecurityConfig verifies the signature, issuer, timestamps, audience, subject, and expiration before accessing todo routes.
Never trust a token merely because it can be decoded. Never put passwords or database secrets in its payload.