--- title: Best JWT posts of 2022 | daily.dev description: The most upvoted JWT posts of 2022, curated by the daily.dev community. canonical: https://daily.dev/tags/jwt/best-of/2022 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/tags/jwt/best-of/2022 og:type: website og:site_name: daily.dev og:title: Best JWT posts of 2022 | daily.dev og:description: The most upvoted JWT posts of 2022, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of JWT — 2022 1. 1 [](/posts/ep34-session-cookie-jwt-token-sso-and-oauth--iurijm82 "EP34: Session, cookie, JWT, token, SSO, and OAuth") Article ByteByteGo · 4y EP34: Session, cookie, JWT, token, SSO, and OAuth The Black Friday sale is now up! Use code BF2022 at checkout for 30% off my system design interview online course. This week’s system design refresher: System design interview course (Black Friday Sale) Token, Cookie, Session What is CDN? 166 5 2. 2 [](/posts/hacking-jwt-7oobbejlk "Hacking JWT") Article System Weakness · 4y Hacking JWT Hacking JWT is most commonly used to identify an authenticated user. In most cases it is used as a “session token’s used in APIs but is used for all types of web apps. We will use a very good tool created to exploit many JWT attacks, I recommend it is very good. To exploit this vulnerability we are going to use a web platform lab called PortSwigger. 123 3 3. 3 [](/posts/jwt-json-web-token--szcruqp7p "JWT (JSON Web Token)") Article DEV · 4y JWT (JSON Web Token) A JWT is used for authorisation and authorisation to make sure that the user that sends a request to your server is the same user that logged in during the authentication process. In JWT instead of cookies, it uses a JWT web token which is what it stands for. The server checks its memory that what the user app is for. 68 1 4. 4 [](/posts/authentication-with-jwt-for-your-website-rqrgdzb4u "Authentication with JWT for your website") Article asayer · 4y Authentication with JWT for your website JWT is a stateless authentication mechanism popularly used as a client-side stateless session. A JWT can be symmetrically signed by a shared secret using the HMAC algorithm. While SAML tokens can use public/private key pairs like JWTs like JWT, the signing algorithm could be HMAC SHA256 or RSA. JWT has some recommendations for JWT developers. For more information about JWT and the signing algorithms. The JWT will be available on the JWT to help users and other services. For example, you can find out how to use JWT in a website and use a JWT on a site and use the J WT on a website. The signature is created by taking the encoded header, the encoded payload, 58 5. 5 [](/posts/web-security-101---part-1-secrets-9wmzb-kme "Web Security 101 - Part 1: Secrets") Article DEV · 4y Web Security 101 - Part 1: Secrets There are ways to expose environment variables to front-end code in the browser. There are packages like dotenv that allow you to configure environment variables in files. You can configure them when you host a site using a platform like Heroku or Netlify. You can also set them in your terminal environment manually. 48 3 6. 6 [](/posts/react-soft-dashboard---fullstack-live-deploy-mnvblsrwh "React Soft Dashboard - FullStack & Live Deploy") Article Community Picks · 4y React Soft Dashboard - FullStack & Live Deploy React Soft Dashboard is a modern design crafted and released for free by Creative-Tim. The product is built with over 70 frontend elements, like buttons, inputs, navbars, cards, or alerts. The UI now uses the latest version provided by and also supports Drag & Drop deployment using the LIVE Deployer Service. 42 7. 7 [](/posts/json-web-tokens-byy-zkiji "JSON Web Tokens") Article InfoSec Write-ups · 4y JSON Web Tokens Each JWT is additionally signed using cryptography (hashing) to ensure that the contents of the JWT cannot be changed by the client or an unsavory party. The JWT will be delivered as a parameter or authorization header from the user agent whenever the user tries to access a protected resource, such as an API or a protected route. 39 1 8. 8 [](/posts/how-jwts-could-be-dangerous-and-its-alternatives-tovlutk77 "How JWTs Could Be Dangerous and Its Alternatives") Article Community Picks · 4y How JWTs Could Be Dangerous and Its Alternatives JWTs are the most popularly used tokens for web authentication and managing user sessions in modern-day software applications. They are a standardized format for securely transferring cryptographically signed data across systems. JWTs can make websites vulnerable to a variety of high-security threats and attacks if not managed properly. 38 6 9. 9 [](/posts/creating-social-logins-in-nestjs-fgiqjfzvm "Creating social logins in NestJS") Article LogRocket · 4y Creating social logins in NestJS The NestJS application can easily be applied to other social platforms, such as Facebook, Google, etc. We’ll then learn how to protect private routes using guards and various authentication and authorization mechanisms provided in NestJS. The first one is authenticating a user through GitHub. Go ahead and install the Passport library and the library for the PASSport GitHub strategy. 33 10. 10 [](/posts/jwt-common-attacks-u-fatuzqz "JWT Common Attacks") Article Dev Genius · 4y JWT Common Attacks JWT doesn’t use the good old cookies and sessions in authorization, instead it utilizes JSON web tokens cookies vs tokens JWT Structure JWT consists of 3 main parts. The Header is the top most part of the JWT token and it specifies which algorithm will be used in the signature part to generate the signature. 30 11. 11 [](/posts/how-to-implement-jwt-authentication-in-nestjs-l3si-xran "How to implement JWT authentication in NestJS") Article LogRocket · 4y How to implement JWT authentication in NestJS The Open Web Application Security Project (OWASP) identifies identification and authentication failures in its top ten web application security risks. This tutorial will demonstrate the step-by-step process for implementing JWT user authentication in NestJS. NestJS is a server-side application framework for Node.js that allows you to create Setting up the MongoDB database. To set up and connect your database, install the Mongoose package, bcrypt, and the NestJS wrapper with the Nest JS wrapper. 27 1 12. 12 [](/posts/deep-dive-into-jwt-attacks-y7qqpb1cl "Deep dive into JWT attacks") Article System Weakness · 4y Deep dive into JWT attacks There are a total of 8 PortSwigger JWT Labs which are an excellent resource for deep diving into JWT attacks. The aim of these labs is to delete the user Carlos through the Admin panel by forging the JWTs. We’ll discover different ways of forging these tokens through these labs. 26 13. 13 [](/posts/how-to-protect-a-route-with-jwt-token-in-react-using-context-api-and-react-cookies-pk4rncftr "How to protect a route with JWT Token in React using Context API and React Cookies") Article DEV · 4y How to protect a route with JWT Token in React using Context API and React Cookies The routes will only be accessible when users have the token saved in cookies or local storage. We’ll learn how to protect a route by JWT authentication in react-router-dom v6. 23 1 14. 14 [](/posts/how-to-test-for-jwt-attacks--5cijzct2a "How to test for JWT attacks?") Article System Weakness · 4y How to test for JWT attacks? A JWT consists of 3 parts: a header, a payload, and a signature. JWT attacks involve a user sending modified JWTs to the server in order to achieve a malicious goal. The data of header & payload can be easily read or modified by anyone with access to the token. 22 15. 15 [](/posts/a-golang-tutorial-about-a-standard-project-structure-with-grpc-sql-and-dependency-injection-gb-bi3as1 "A Golang Tutorial about a standard project structure with gRPC, SQL, and Dependency Injection") Article Golang News · 4y A Golang Tutorial about a standard project structure with gRPC, SQL, and Dependency Injection A Golang Tutorial about a standard project structure with gRPC, SQL, and Dependency Injection. We are going to create a basic login gR PC API, and when you finish, you will know how Standard g RPC API features are implemented in Golang. 17 16. 16 [](/posts/4-common-mistakes-made-by-node-js-developers-kudxj5w9o "4 Common Mistakes Made by Node.js Developers") Article Medium · 4y 4 Common Mistakes Made by Node.js Developers The growth of Node.js is tremendous, it has a rich packages ecosystem, it’s battle-tested and the usage of JavaScript allows businesses to go truly full-stack and cut the development lifecycle short. But with great powers comes great responsibility ( as I previously mentioned in my JWT article) After reflecting on the past 8 years. 14 1 17. 17 [](/posts/the-four-mistakes-you-make-building-permissions-fkspgnmfn "The four mistakes you make building permissions") Article Permit.io · 4y The four mistakes you make building permissions Developers often overuse JWTs, sometimes going as far as storing all the routes that a user should access within them. Mixing the authentication and authorization layers messes up our code. The best way to avoid this is to have the JWT only include the claims and scopes for the user's identity and their relationship within the organization and keep all other authorization-related information. 13 [See all JWT archives](/tags/jwt/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/tags/jwt/best-of/2022#page","url":"https://daily.dev/tags/jwt/best-of/2022","name":"Best JWT Posts of 2022","description":"The most upvoted JWT posts of 2022, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/tags/jwt/best-of/2022#items","numberOfItems":17,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/ep34-session-cookie-jwt-token-sso-and-oauth--iurijm82","name":"EP34: Session, cookie, JWT, token, SSO, and OAuth"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/hacking-jwt-7oobbejlk","name":"Hacking JWT"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/jwt-json-web-token--szcruqp7p","name":"JWT (JSON Web Token)"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/authentication-with-jwt-for-your-website-rqrgdzb4u","name":"Authentication with JWT for your website"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/web-security-101---part-1-secrets-9wmzb-kme","name":"Web Security 101 - Part 1: Secrets"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/react-soft-dashboard---fullstack-live-deploy-mnvblsrwh","name":"React Soft Dashboard - FullStack & Live Deploy"},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/json-web-tokens-byy-zkiji","name":"JSON Web Tokens"},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/how-jwts-could-be-dangerous-and-its-alternatives-tovlutk77","name":"How JWTs Could Be Dangerous and Its Alternatives"},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/creating-social-logins-in-nestjs-fgiqjfzvm","name":"Creating social logins in NestJS"},{"@type":"ListItem","position":10,"url":"https://daily.dev/posts/jwt-common-attacks-u-fatuzqz","name":"JWT Common Attacks"},{"@type":"ListItem","position":11,"url":"https://daily.dev/posts/how-to-implement-jwt-authentication-in-nestjs-l3si-xran","name":"How to implement JWT authentication in NestJS"},{"@type":"ListItem","position":12,"url":"https://daily.dev/posts/deep-dive-into-jwt-attacks-y7qqpb1cl","name":"Deep dive into JWT attacks"},{"@type":"ListItem","position":13,"url":"https://daily.dev/posts/how-to-protect-a-route-with-jwt-token-in-react-using-context-api-and-react-cookies-pk4rncftr","name":"How to protect a route with JWT Token in React using Context API and React Cookies"},{"@type":"ListItem","position":14,"url":"https://daily.dev/posts/how-to-test-for-jwt-attacks--5cijzct2a","name":"How to test for JWT attacks?"},{"@type":"ListItem","position":15,"url":"https://daily.dev/posts/a-golang-tutorial-about-a-standard-project-structure-with-grpc-sql-and-dependency-injection-gb-bi3as1","name":"A Golang Tutorial about a standard project structure with gRPC, SQL, and Dependency Injection"},{"@type":"ListItem","position":16,"url":"https://daily.dev/posts/4-common-mistakes-made-by-node-js-developers-kudxj5w9o","name":"4 Common Mistakes Made by Node.js Developers"},{"@type":"ListItem","position":17,"url":"https://daily.dev/posts/the-four-mistakes-you-make-building-permissions-fkspgnmfn","name":"The four mistakes you make building permissions"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tags","item":"https://daily.dev/tags"},{"@type":"ListItem","position":3,"name":"JWT","item":"https://daily.dev/tags/jwt"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/tags/jwt/best-of"},{"@type":"ListItem","position":5,"name":"2022"}]}]} ```