Isihlaziyi se-JWT

Yini ngempela i-JWT Decoder eyenzayo

I-JSON Web Token (JWT) ibukeka njengohlamvu olude, olungaqondakali lwezimpawu ezingahlelekile, kodwa ayibethelwe futhi ayisona isihlungu esiyimfihlo. Umgodla ophelele, ovikelekile we-URL othwala idatha ehlelekile phakathi kwezinhlangothi ezimbili. Namathisela ithokheni ohlelisini olungenhla futhi liyolwahlukanisa lolo hlamvu bese likukhombisa i-JSON yangempela engaphakathi — imininingwane engenhla, izimangalo, ukuthi ithokheni yenzelwe ubani, kanye nokuthi iphelelwa isikhathi nini. Konke kwenzeka ngqo esipheqululini sakho. Ithokheni ayilokothi ingeniswe, ibhalwe phansi, noma ithunyelwe kunoma iyiphi indawo, futhi lokhu kubaluleke kakhulu uma into oyihlolisisayo iyisitifiketi sesikhathi soqobo esisebenzayo.

Izingxenye ezintathu, amachaphaza amabili

Wonke i-JWT ehleleke kahle izinhlamvu ezintathu ezibhalwe nge-Base64url ezihlanganiswe ngamachaphaza: umqondiso.umthwalo.isayino. Lolo phawu lwechaphaza olulodwa yindlela abahumushi bazi ngayo lapho ingxenye eyodwa iphela khona nalapho enye iqala khona, futhi yingakho ithokheni enenani elingafanele lamachaphaza inqatshwa ngaphambi kokuthi noma yini eyodwa ifundwe.

I-header yinto encane ye-JSON echaza ithokheni ngokwayo. Ihlala inayo i-typ (uhlobo, ngokuvamile JWT) kanye ne-alg — i-algorithm yesayino, njenge-HS256 (i-HMAC ene-SHA-256) noma i-RS256 (i-RSA ene-SHA-256). I-header itshela umqinisekisi kanjani kanye ngokuphelele indlela isayino eyakhiwe ngayo.

I-payload yingxenye abantu abaningi abakhathazekile ngayo kakhulu. Yenye into ye-JSON ephethe izimangalo — izitatimende mayelana nomsebenzisi kanye nethokheni. Isipesheli sihlela izimangalo zibe ezibhalisiwe (ezijwayelekile, amagama agodliwe), ezomphakathi, kanye nezangasese (amagama akhethekile owazicabangela wona uqobo lwaphuthi lakho). Ukuhumusha i-payload yikho okuveza ukuthi ubani ongenile, indima anayo, kanye nokuthi isikhathi sakhe siphela nini.

I-signature uphawu lwesibethela obethelweko. Ibalwe ngaphezu kwe-header ne-payload ebhaliwe kusetshenziswa i-algorithm evela ku-header kanye nesikhiye esifihlekile noma esizimele. Ngoba ibhekana nazo zombili ezinye izingxenye, noma yiluphi ushintsho ku-header noma ku-payload — ngisho nohlamvu olulodwa — luyayenza ingasebenzi.

Izimangalo ozobona kakhulu

Izimangalo ezibhalisiwe amagama amafushane, onobumba abathathu achazwe yi-RFC 7519 ukuze izinhlelo ezahlukene zisebenzisane. Ambalwa avela cishe yonke indawo:

• iss — issuer: ubani okhiqize ithokheni (iseva yakho yokuqinisekisa noma umhlinzeki wobunikazi).
• sub — subject: umuntu ithokheni ikhuluma ngaye, ngokuvamile i-ID yomsebenzisi ezimele.
• aud — audience: umamukeli ithokheni eyenzelwe yena. I-API kufanele inqabe amathokheni obumamukeli bawo obungeyona wona.
• exp — expiration time: isikhathi se-Unix ngemva kwaso ithokheni akufanele yamukelwe.
• iat — issued at: isikhathi se-Unix lapho ithokheni yakhiwa khona.

Ungase futhi uhlangane ne-nbf (not before) kanye ne-jti (i-ID ekhethekile yethokheni). Izikhathi zisemasekhondini kusukela ngo-1970 ku-UTC, yingakho umhumushi ozidwebe njengezinsuku ezifundeka lula ukugcina isikhathi sokucabanga uma uhlola ukuthi ithokheni isiphelile.

Ukuhumusha akusiwo ukuqinisekisa — yile ngxenye ehlaba abantu

Lo mehluko yiwo into ebaluleke kakhulu okumele iqondwe mayelana namaJWT. Ukuhumusha kusho ukufunda okuqukethwe: akudingi sikhiye futhi noma ubani ophethe ithokheni angakwenza, ngoba i-Base64url wuhlobo lokubhala, hhayi ukubethela. Ukuqinisekisa kusho ukufakazela ukuthi ithokheni iqinisile futhi ayithintekanga — ukubala kabusha isayino ngesikhiye esifanele noma esizimele bese kuqinisekiswa ukuthi kuyahambisana.

Leli thuluzi liyahumusha. Likukhombisa lokho ithokheni ekushoyo, hhayi ukuthi ithokheni ingathenjwa yini. Ithokheni ingase ibe ngekhiwe ngamanga, iphelelwe isikhathi, noma iphindwe futhi ihumushele i-JSON ebukeka ihlanzekile. Ungalokothi wenze isinqumo sokugunyaza usekele kuphela kuzimangalo ezihunyushiwe. Ekukhiqizeni empeleni uqinisekisa isayino ohlangothini lweseva, uhlole i-exp, futhi uqinisekise ukuthi i-iss ne-aud kuhambisana nalokho okulindele — usebenzisa umtapo ohlolisisiwe, hhayi ukuqhathanisa uhlamvu ngesandla.

I-payload akuyona ivolti

Ngoba i-payload ibhalwe nge-Base64url kuphela, iyafundeka noma ubani oyihlobisa ithokheni. Phatha konke okukuyo njengokuphephile emphakathini. Ungafaki amaphasiwedi, izinombolo eziphelele zamakhadi esikweletu, izikhiye eziyimfihlo, noma noma yikuphi ukufaka kwabantu okubucayi ezimangalweni ze-JWT — uma ungakwazi ukukuhumusha lapha ngokuchofoza kanye, kanjalo nawo wonke omunye umuntu othola ikhophi. Isayino ivikela ekulawuleni ukuguqulwa, akulokothi ivikele ukufundwa. Uma ngempela udinga ukufihla okuqukethwe kwe-payload, lowo umsebenzi we-JWE (amathokheni abethelweko), isipesheli esihlukile ngokuphelele.

Ubumfihlo namathuluzi ahlobene

Ukuhlolisisa ithokheni yisenzo esibucayi, ngakho lo mhumushi usebenza ngokuphelele ohlangothini lwekhasimende — ukuhlaziya yi-JavaScript ejwayelekile ethebhini yakho futhi akukho lutho oluphuma emshinini wakho. Ukunamathisela ithokheni yesikhathi soqobo ethulwini elisekelwe yiseva kusho ukunikeza isitifiketi sesikhathi soqobo esisebenzayo kumuntu wesithathu, okuyikho kanye okumele ukugweme. Yofuna ukubhala okusuka ngezansi, bheka ithuluzi lethu le-Base64, futhi uphequlule wonke amanye amathuluzi ethu omthuthukisi lokuthola amanye amathuluzi asebenza edivayisini.

Imibuzo evame ukubuzwa