In the previous example, we covered how to use Keycloak to authenticate and authorize requests using a bearer token. A bearer token alone, however, is a simplified security schema since it's based on exchanging a potentially arbitrary string.
Any client in possession of a valid bearer token can use it to get access to the associated resources without demonstrating his/her identity, which can only be verified with a cryptographic key. In order to fill this gap, we will learn how to use JSON Web Tokens (JWTs), an encoding standard for tokens, using a JSON data payload that can be signed and encrypted. A JWT includes the following sections:
- Header: This is a Base64-encoded string and consists of two parts: the type of the token, which is JWT, and the hashing algorithm being used, such as HMAC SHA256 or RSA. Here is a sample decoded...
