Things Every Developer Should Know: JSON Web Token.
JWTs are one of the most widely used methods for API authentication, providing a secure, stateless and scalable way to verify clients.
\ud835\udddb\ud835\uddf2\ud835\uddff\ud835\uddf2\u2019\ud835\ude00 \ud835\uddee \ud835\ude00\ud835\uddf6\ud835\uddfa\ud835\uddfd\ud835\uddf9\ud835\uddf2-\ud835\ude01\ud835\uddfc-\ud835\ude02\ud835\uddfb\ud835\uddf1\ud835\uddf2\ud835\uddff\ud835\ude00\ud835\ude01\ud835\uddee\ud835\uddfb\ud835\uddf1 \ud835\uddef\ud835\uddff\ud835\uddf2\ud835\uddee\ud835\uddf8\ud835\uddf1\ud835\uddfc\ud835\ude04\ud835\uddfb \ud835\uddfc\ud835\uddf3 \ud835\uddf5\ud835\uddfc\ud835\ude04 \ud835\uddf6\ud835\ude01 \ud835\ude04\ud835\uddfc\ud835\uddff\ud835\uddf8\ud835\ude00, \ud835\ude00\ud835\ude01\ud835\uddf2\ud835\uddfd \ud835\uddef\ud835\ude06 \ud835\ude00\ud835\ude01\ud835\uddf2\ud835\uddfd:
\ud835\udfed) \ud835\uddd6\ud835\uddf9\ud835\uddf6\ud835\uddf2\ud835\uddfb\ud835\ude01 \ud835\uddee\ud835\ude02\ud835\ude01\ud835\uddf5\ud835\uddf2\ud835\uddfb\ud835\ude01\ud835\uddf6\ud835\uddf0\ud835\uddee\ud835\ude01\ud835\uddf6\ud835\uddfc\ud835\uddfb
The client (a user, app, or device) provides credentials (eg; username\/password) to the authentication server.
\ud835\udfee) \ud835\udde6\ud835\uddf2\ud835\uddff\ud835\ude03\ud835\uddf2\ud835\uddff \ud835\ude03\ud835\uddf2\ud835\uddff\ud835\uddf6\ud835\uddf3\ud835\uddf6\ud835\uddf0\ud835\uddee\ud835\ude01\ud835\uddf6\ud835\uddfc\ud835\uddfb
The authentication server checks the credentials against its database or identity provider to confirm their validity.
\ud835\udfef) \ud835\udddd\ud835\uddea\ud835\udde7 \ud835\uddf6\ud835\ude00\ud835\ude00\ud835\ude02\ud835\uddee\ud835\uddfb\ud835\uddf0\ud835\uddf2
If authentication is successful, the server:
\u2611 Generates a JWT with claims (eg; user ID, roles, permissions).
\u2611 Signs the JWT using a secret key (HS256) or a private key (RS256).
\ud835\udff0) \ud835\udde7\ud835\uddfc\ud835\uddf8\ud835\uddf2\ud835\uddfb \ud835\uddf1\ud835\uddf2\ud835\uddf9\ud835\uddf6\ud835\ude03\ud835\uddf2\ud835\uddff\ud835\ude06
The server sends the signed JWT back to the client in the response.
\ud835\udff1) \ud835\udde6\ud835\uddf2\ud835\uddf0\ud835\ude02\ud835\uddff\ud835\uddf2 \ud835\ude00\ud835\ude01\ud835\uddfc\ud835\uddff\ud835\uddee\ud835\uddf4\ud835\uddf2
The client stores the JWT securely to prevent unauthorized access. HTTP-only cookies are the most secure and widely used method.
\ud835\udff2) \ud835\uddd4\ud835\udde3\ud835\udddc \ud835\uddff\ud835\uddf2\ud835\uddfe\ud835\ude02\ud835\uddf2\ud835\ude00\ud835\ude01\ud835\ude00 \ud835\ude04\ud835\uddf6\ud835\ude01\ud835\uddf5 \ud835\udddd\ud835\uddea\ud835\udde7
For each request to a protected API, the client includes the JWT in the Authorization header:
`Authorization: Bearer <JWT>`
\ud835\udff3) \ud835\udde6\ud835\uddf2\ud835\uddff\ud835\ude03\ud835\uddf2\ud835\uddff \ud835\ude03\ud835\uddee\ud835\uddf9\ud835\uddf6\ud835\uddf1\ud835\uddee\ud835\ude01\ud835\uddf2\ud835\ude00 \ud835\ude01\ud835\uddf5\ud835\uddf2 \ud835\udddd\ud835\uddea\ud835\udde7
The API server verifies the JWT before granting access by checking:
\u2611 Signature \u2013 Confirms token integrity (not tampered with).
\u2611 Expiration \u2013 Ensures the token hasn\u2019t expired.
\u2611 Audience (aud claim) \u2013 Checks if the token is meant for this API.
\u2611 Issuer (iss claim) \u2013 Confirms the token was issued by a trusted authority.
If the JWT is valid, the server grants access to the requested resource. Otherwise, it rejects the request (401 Unauthorized).
\ud835\udff4) \ud835\udde7\ud835\uddfc\ud835\uddf8\ud835\uddf2\ud835\uddfb \ud835\uddf2\ud835\ude05\ud835\uddfd\ud835\uddf6\ud835\uddff\ud835\uddee\ud835\ude01\ud835\uddf6\ud835\uddfc\ud835\uddfb & \ud835\uddff\ud835\uddf2\ud835\uddf3\ud835\uddff\ud835\uddf2\ud835\ude00\ud835\uddf5
Since JWTs expire for security reasons, the client needs a refresh token to get a new one:
\u21b3 Client sends refresh token to the server.
\u21b3 Server verifies & issues a new JWT if the refresh token is valid.
\u21b3 New JWT replaces the expired one, and the client continues making requests.<\/p>","protected":false},"excerpt":{"rendered":"
Things Every Developer Should Know: JSON Web Token. JWTs are one of the most widely used methods for API authentication, providing a secure, stateless and scalable way to verify clients. \ud835\udddb\ud835\uddf2\ud835\uddff\ud835\uddf2\u2019\ud835\ude00 \ud835\uddee \ud835\ude00\ud835\uddf6\ud835\uddfa\ud835\uddfd\ud835\uddf9\ud835\uddf2-\ud835\ude01\ud835\uddfc-\ud835\ude02\ud835\uddfb\ud835\uddf1\ud835\uddf2\ud835\uddff\ud835\ude00\ud835\ude01\ud835\uddee\ud835\uddfb\ud835\uddf1 \ud835\uddef\ud835\uddff\ud835\uddf2\ud835\uddee\ud835\uddf8\ud835\uddf1\ud835\uddfc\ud835\ude04\ud835\uddfb \ud835\uddfc\ud835\uddf3 \ud835\uddf5\ud835\uddfc\ud835\ude04 \ud835\uddf6\ud835\ude01 \ud835\ude04\ud835\uddfc\ud835\uddff\ud835\uddf8\ud835\ude00, \ud835\ude00\ud835\ude01\ud835\uddf2\ud835\uddfd \ud835\uddef\ud835\ude06 \ud835\ude00\ud835\ude01\ud835\uddf2\ud835\uddfd: \ud835\udfed) \ud835\uddd6\ud835\uddf9\ud835\uddf6\ud835\uddf2\ud835\uddfb\ud835\ude01 \ud835\uddee\ud835\ude02\ud835\ude01\ud835\uddf5\ud835\uddf2\ud835\uddfb\ud835\ude01\ud835\uddf6\ud835\uddf0\ud835\uddee\ud835\ude01\ud835\uddf6\ud835\uddfc\ud835\uddfbThe client (a user, app, or device) provides credentials (eg; username\/password) to […]<\/p>\n","protected":false},"author":1,"featured_media":12599,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"class_list":["post-12598","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web"],"_links":{"self":[{"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/posts\/12598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/comments?post=12598"}],"version-history":[{"count":1,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/posts\/12598\/revisions"}],"predecessor-version":[{"id":12600,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/posts\/12598\/revisions\/12600"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/media\/12599"}],"wp:attachment":[{"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/media?parent=12598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/categories?post=12598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mounirmaaroufi.com\/fr\/wp-json\/wp\/v2\/tags?post=12598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}