Stage 3 · Build

Authentication & Authorization

JWT Authentication

Issue and verify JWTs with claims, expiry, signing keys, refresh tokens, and revocation lists.

8 min readBuilding Backend ApplicationsBuild

What Are JWTs

JSON Web Tokens are self-contained tokens that carry user claims. Unlike sessions, JWTs are stateless — the server verifies them without a database lookup. This makes them ideal for distributed systems and APIs.

JWT Structure

A JWT has three parts: header, payload, and signature. The header specifies the algorithm. The payload contains claims (user ID, role, expiry). The signature proves the token was issued by your server and has not been tampered with.

JWT format


eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiMTIzIiwicm9sZSI6ImFkbWluIiwiZXhwIjoxNzAwMDAwMDAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Each part is base64url-encoded. The header and payload are not encrypted — they are readable by anyone. The signature prevents tampering. Never put secrets in the payload.

Issuing JWTs

Gocreating-jwts-with-jose.go

22 linesLn 1, Col 1Go

Use short expiry for access tokens (15 minutes). Store minimal claims — user ID and role. Never put sensitive data in the payload since it is base64-encoded, not encrypted.

Verifying JWTs

Goverifying-jwts.go

40 linesLn 1, Col 1Go

Parse the token, verify the signature with your secret, check expiry. If any step fails, return 401. Store user ID in context for downstream handlers.

Refresh Tokens

Access tokens expire quickly (15 minutes). Refresh tokens live longer (7 days) and are used to get new access tokens without re-authenticating. Store refresh tokens server-side for revocation capability.

Gorefresh-token-pattern.go

31 linesLn 1, Col 1Go

Always rotate refresh tokens on use. The old refresh token is invalidated and a new one is issued. This limits the window if a refresh token is compromised.

Revocation

JWTs are stateless — they are valid until they expire. To revoke a JWT before expiry, you need a revocation list. Store revoked token IDs in Redis with the token's remaining TTL.

Gojwt-revocation-list.go

31 linesLn 1, Col 1Go

Revocation adds a Redis lookup on every request, which is the cost of stateless tokens with revocation. For most APIs, this is acceptable. If not, use sessions instead.

JWTs vs Sessions

JWTs are best for distributed APIs where sessions are impractical. Sessions are simpler, support instant revocation, and do not need token rotation. For web applications with a single backend, sessions are usually the better choice.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.

Stage 3 · Build

Authentication & Authorization

JWT Authentication

Issue and verify JWTs with claims, expiry, signing keys, refresh tokens, and revocation lists.

8 min readBuilding Backend ApplicationsBuild

What Are JWTs

JWT Structure

JWT format


eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiMTIzIiwicm9sZSI6ImFkbWluIiwiZXhwIjoxNzAwMDAwMDAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Each part is base64url-encoded. The header and payload are not encrypted — they are readable by anyone. The signature prevents tampering. Never put secrets in the payload.

Issuing JWTs

Gocreating-jwts-with-jose.go

22 linesLn 1, Col 1Go

Use short expiry for access tokens (15 minutes). Store minimal claims — user ID and role. Never put sensitive data in the payload since it is base64-encoded, not encrypted.

Verifying JWTs

Goverifying-jwts.go

40 linesLn 1, Col 1Go

Parse the token, verify the signature with your secret, check expiry. If any step fails, return 401. Store user ID in context for downstream handlers.

Refresh Tokens

Gorefresh-token-pattern.go

31 linesLn 1, Col 1Go

Always rotate refresh tokens on use. The old refresh token is invalidated and a new one is issued. This limits the window if a refresh token is compromised.

Revocation

JWTs are stateless — they are valid until they expire. To revoke a JWT before expiry, you need a revocation list. Store revoked token IDs in Redis with the token's remaining TTL.

Gojwt-revocation-list.go

31 linesLn 1, Col 1Go

Revocation adds a Redis lookup on every request, which is the cost of stateless tokens with revocation. For most APIs, this is acceptable. If not, use sessions instead.

JWTs vs Sessions

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.