Chiunque può decifrare o leggere un token JWT?
Sì, i token JSON Web Tokens standard (JWS) sono firmati, non cifrati. Header e payload sono semplici stringhe codificate in Base64URL che chiunque può decodificare e leggere in chiaro senza la chiave segreta.
Detailed Technical Explanation
La quasi totalità dei token utilizzati nel web sono JWS (RFC 7515). La firma digitale garantisce integrità e autenticità, ma non nasconde il contenuto. Per garantire la riservatezza delle informazioni, è necessario adottare JWE (RFC 7516).
Technical Example & Code
Qualsiasi client può visualizzare i campi del payload effettuando una decodifica Base64URL.
const token = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTYiLCJyb2xlIjoiYWRtaW4ifQ.signature";
const payloadB64 = token.split('.')[1];
const decodedClaims = JSON.parse(atob(payloadB64.replace(/-/g, '+').replace(/_/g, '/')));
console.log(decodedClaims);
// Output: { sub: "123456", role: "admin" }Why This Is the Case (Underlying Architectural Rationale)
"Lo standard RFC 7519 è stato concepito per consentire verifiche rapide e distribuite senza sovraccaricare i server con operazioni di decifratura ad ogni richiesta."
Common Misconception vs Reality
"La firma del JWT cifra il payload impedendo la lettura dei dati."
La firma digitale protegge esclusivamente dalla manipolazione. Non inserire mai password o credenziali riservate nel payload di un JWT.
Related Curious-Techie Resources
Ultimate Guide to JWT Authentication & Security →
Master token architecture, signature algorithms, refresh token rotation, and storage best practices.
Interactive ToolJWT Decoder & Inspector →
Paste any JWT to instantly view decoded headers, claims, and signature validity in browser memory.
Developer ReferenceJWT Claims Reference & Specifications →
Related Questions in the Q&A Knowledge Base
You should not store authentication JWTs in localStorage because any Cross-Site Scripting (XSS) vulnerability on your page allows malicious JavaScript to instantly read and exfiltrate the token. Storing tokens in HttpOnly, Secure, SameSite cookies protects them from JavaScript access.
Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
Ecosistema Tecnico Correlato e Passaggi Successivi
Articoli Tecnici Correlati
What Is a JSON Web Token (JWT)?
Direct definition and architectural breakdown of stateless token exchange.
JWT vs Session-Based Authentication: Architecture & Performance
Compare database session lookups with stateless JWT verification across scalability and revocation.
Troubleshooting: JWT Works in Postman but Fails in Browser
Diagnose and remediate CORS header stripping, HttpOnly cookie constraints, and preflight authorization failures.
Laboratori Pratici di Diagnosi
Specifiche e Standard di Riferimento
Continua ad Imparare
JWT Interactive Tampering & Validation Lab
Put your theoretical understanding into practice by tampering with claims and testing signature rejection in the live sandbox.