JWT: Symmetric and Asymmetric key Implementation

Prerequisite: Understanding of JWT or read here to understand what is JSON Web token.

As we already know that JWT is special because it is digitally signed and we can verify the authenticity of JWT using signature.

Today, we will discuss on how we can actually sign this JWT using Symmetric and Asymmetric key.

Symmetric key: Symmetric key uses the same key for the signature generation as well as at the time of token verification. So, extra precaution is required during the exchange of the secret key between sender and receiver.Use symmetric key if there is one sender and one receiver, the exchanging of the key will be easy. 

Eg: One web application talking to the backend services.

Asymmetric key: It uses a key pair. The key pair consists of a public key and a private key. JSON data will be signed using the private key and can be verified using the public key.

Use Asymmetric key if you have one sender and multiple receivers as you cannot share the same key to all the end parties.
Eg: Centralized application.

There are various open source libraries using which we can create and verify the access token like Stormpath and Auth0 libraries.

Click here to download the source code from GITHUB.