diff options
Diffstat (limited to 'content/JWT.md')
-rw-r--r-- | content/JWT.md | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/content/JWT.md b/content/JWT.md index 46da1a2..e77457f 100644 --- a/content/JWT.md +++ b/content/JWT.md | |||
@@ -7,15 +7,15 @@ weight = 4 | |||
7 | > JSON Web Tokens are representations of claims, or authorization proofs that fit into the `Header` of HTTP requests. | 7 | > JSON Web Tokens are representations of claims, or authorization proofs that fit into the `Header` of HTTP requests. |
8 | 8 | ||
9 | # How? | 9 | # How? |
10 | 10 | JWTs are used as the [MAC](https://en.wikipedia.org/wiki/Message_authentication_code) of operations that require authorization. | |
11 | JWTs are used as the [MAC](https://en.wikipedia.org/wiki/Message_authentication_code) of operations that require authorization: | 11 | Gradecoin has 2 such operations: |
12 | - block proposal | 12 | - block proposal |
13 | - transaction proposal. | 13 | - transaction proposal. |
14 | 14 | ||
15 | They are send alongside the JSON request body in the `Header`; | 15 | They are sent alongside the JSON request body in the `Header`; |
16 | 16 | ||
17 | ```html | 17 | ``` |
18 | Authorization: Bearer aaaaaa.bbbbbb.ccccc | 18 | Authorization: Bearer <JWT Token here> |
19 | ``` | 19 | ``` |
20 | 20 | ||
21 | Gradecoin uses 3 fields for the JWTs; | 21 | Gradecoin uses 3 fields for the JWTs; |
@@ -29,11 +29,13 @@ Gradecoin uses 3 fields for the JWTs; | |||
29 | ``` | 29 | ``` |
30 | 30 | ||
31 | - `tha` is explained in [blocks](@/block_docs.md) and [transactions](@/transaction_docs.md) documentations. | 31 | - `tha` is explained in [blocks](@/block_docs.md) and [transactions](@/transaction_docs.md) documentations. |
32 | - `iat` when the JWT was created in [Unix Time](https://en.wikipedia.org/wiki/Unix_time) format | 32 | - `iat` when the JWT was created in [Unix Time](https://en.wikipedia.org/wiki/Unix_time) format. |
33 | - `exp` when the JWT will expire & be rejected in [Unix Time](https://en.wikipedia.org/wiki/Unix_time) | 33 | - `exp` when the JWT will expire & be rejected in [Unix Time](https://en.wikipedia.org/wiki/Unix_time). |
34 | 34 | ||
35 | # Algorithm | 35 | # Algorithm |
36 | We are using [RS256](https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1), `RSASSA-PKCS1-v1_5 using SHA-256`. The JWTs you encode with your private RSA key will be decoded using the public key you have authenticated with. You can see how the process works [here](https://jwt.io/). | 36 | We are using [RS256](https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1), `RSASSA-PKCS1-v1_5 using SHA-256`. |
37 | The JWTs you encode with your private RSA key will be decoded using the public key you have authenticated with. | ||
38 | You can see how the process works and create ad hoc tokens [here](https://jwt.io/). | ||
37 | 39 | ||
38 | # References | 40 | # References |
39 | - [RFC, the ultimate reference](https://tools.ietf.org/html/rfc7519) | 41 | - [RFC, the ultimate reference](https://tools.ietf.org/html/rfc7519) |