The Desi Architect
Notes / Docker Sandboxes / JWT and Auth Basics: Tokens, Signatures, 401 vs 403
Docker Sandboxes · Tier 1: Building Blocks · Lab 19

JWT and Auth Basics: Tokens, Signatures, 401 vs 403

What is a token? Log in, get a JWT, read what is inside it with no key, and see why the payload is not secret but cannot be changed. Tamper with it, let it expire, forge one with alg none, and see 401 and 403 for the right reasons.

Time30 minutes
StackJWT (HS256)Ports 18151
MemoryAbout 30 MB
Before thisLab 03HTTP Caching Headers & DNS Resolut
Download lab (.zip) View steps
Verified runWindows, Mac, LinuxBash and PowerShell
  1. 1PrepareWhat you will learn
  2. 2PredictGuess before you run
  3. 3RunStep by step
  4. 4ObserveWhat you should see
  5. 5Break itChange one thing
  6. 6Clean upLeave nothing running
On this page
  1. 00 / What You Will Learn
  2. 01 / Why It Matters
  3. 02 / What We Are Building
  4. 03 / Words You Need
  5. 04 / Predict First
  6. 05 / Step by Step
  7. 06 / What You Should See
  8. 07 / Look Inside
  9. 08 / Break It, Fix It
  10. 09 / In Real Projects
  11. 10 / Interview Corner
  12. 11 / Clean Up

00 /What You Will Learn

By the end you will be able to
  • Say what a token is and why servers hand them out after login.
  • Read the three parts of a JWT: header, payload and signature.
  • Explain why the payload is not secret, and why it cannot be changed.
  • Show what happens when a token is tampered with, forged with alg: none, or expired.
  • Tell 401 from 403.

Before you start

Finish Lab 03 (HTTP, Caching and DNS) first. You should know what a header and a status code are. You do not need any security background.

Lab-only secret

The key that signs tokens in this lab is lab-only-secret. It is for practice on your own laptop. A real secret is long, random, and never written in code or committed to git.