Auth & Security · 02 JWT Structure

Header · Payload · Signature

Take a real token apart, then try to forge one. Walk it with Next.

→Base64 is encoding, not encryption. Anyone holding the token can read the payload.

✗Never put passwords, emails or other private data in the payload.

✓The signature makes it tamper-proof — change one character and verification fails.

→Stateless: the server checks the signature with its secret — no database lookup per request.

The claims every access token needs

Registered claim names are short on purpose — the token travels with every request.

Claim

Meaning

Example

sub

who the token is about

"42" — the user id

iat

issued at (unix seconds)

1790000000

exp

expires at (unix seconds)

iat + 15 min

jti

unique token id

for revocation (session 04)

role

custom claim

"user" — for RBAC (session 05)

demos/02/main.go

import "github.com/golang-jwt/jwt/v5"

claims := jwt.MapClaims{
    "sub":  "42",
    "role": "user",
    "iat":  now.Unix(),
    "exp":  now.Add(15 * time.Minute).Unix(),
}
tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
s, err := tok.SignedString(secret)

go run ./demos/02

header  {"alg":"HS256","typ":"JWT"}
payload {"exp":1790000900,"iat":1790000000,"role":"user","sub":"42"}
forged :   token signature is invalid: signature is invalid
genuine:   <nil>
16m later: token has invalid claims: token is expired

→exp is checked by the library automatically — an expired token fails Parse.

→Keep access tokens short-lived (5–15 min): a stolen token is only useful until exp.

→The secret comes from config, is ≥ 32 random bytes, and never appears in code.

TASK

Break your own token

Sign a token, paste it into any JWT decoder and read the payload.
Change one letter of the payload and parse it — note the error.
Sign with a 1-minute exp, wait, parse again.

Recap

Session 02 in four lines

1A JWT is base64(header).base64(payload).signature.

2Readable by anyone — secret from no one. Keep the payload boring.

3The HMAC signature over header + payload is what makes it trustworthy.

4sub, iat, exp on every access token; keep exp short.