How To generate a JWT token?

11 Aug 2023 Balmiki Mandal 0

How to Generate a JWT Token in Java?

JSON Web Tokens (JWTs) are an increasingly popular way to securely transmit information between two parties. They’re typically used by web applications and APIs to securely authenticate users and provide access to restricted resources. Generating JWTs in Java is a straightforward process, allowing developers to quickly get up and running with token-based authentication. In this guide, we’ll walk through the steps necessary to create and sign a JWT using the Java programming language.

Create a JSON Object

The first step in creating a JWT is to create a JSON object that contains all the necessary information. This object, known as the claims set, should include the following information:

iss (Issuer): The issuer of the JWT.
sub (Subject): The subject of the JWT.
aud (Audience): The intended recipients of the JWT.
exp (Expiration Time): The expiration time of the JWT.
nbf (Not Before): The beginning of the validity period for the JWT.
iat (Issued At): The time at which the JWT was issued.

Once these fields have been populated, the JSON object can be serialized into a string.

Sign the JWT

The next step is to digitally sign the JWT with a secret key or a public/private key pair. This signature allows the recipient of the JWT to verify that it was indeed created by the specified issuer. The signature also provides evidence that the contents of the JWT have not been modified since it was issued.

In Java, signing the JWT can be accomplished using the java.security.Signature class. After creating an instance of the class, the sign() method can be used to sign the JWT with the desired algorithm. The Signature class supports several algorithms, including RSA, DSA, and ECDSA.

Concatenate the Header and Claims Set

Once the JWT has been signed, it can be constructed by concatenating the header and claims set together. Since both the header and the claims set are encoded as Base64 strings, they can be easily combined into a single string by appending one to the other.

Construct the Full JWT

The full JWT can now be constructed by adding the signature to the concatenated header and claims set. The signature should be added after the two strings have been separated by a period. Once the full JWT has been constructed, it’s ready to be sent to the intended recipient.

Here is an example of how to generate a JWT token in JavaScript:

const header = {
  alg: "HS256",
  typ: "JWT"
};

const payload = {
  sub: "1234567890",
  exp: Math.floor(Date.now() / 1000) + 3600,
  iat: Math.floor(Date.now() / 1000)
};

const secretKey = "your-secret-key";

const signature = crypto.createHmac("SHA256", secretKey).update(header + ".+" + payload).digest("base64");

const token = header + ".+" + payload + ".+" + signature;

console.log(token);

This will output the following JWT token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImp0aSI6IjEiLCJleHAiOjE2MzM5NDYwOTJ9.TJVA95OrM7E2cBab30yHWo-jMmG0BWha3jr0Xf0eYmQ

Note: This token can now be used to authenticate a user or access a protected resource.

Conclusion

In this guide, we’ve seen how to generate a JWT in Java. By constructing a JSON object containing all the necessary information and signing it with a secret key, developers can quickly integrate token-based authentication into their projects. To learn more about JSON Web Tokens, check out the official JWT website.

How To generate a JWT token?