Some of these claims and their meaning are defined as part of the JWT spec. Others are user-defined. The magic behind JWTs is that they standardize certain claims that are useful in the context of some common operations. For example, one of these common operations is establishing the identity of a certain party. So one of the standard claims found in JWTs is the sub (from “subject”) claim.

What are claims?

Difficulty: 6/10

JWT Payload, Token-based Auth, Access Control

Claims are definitions or assertions made about a certain party or object.

1
Some of these claims and their meaning are defined as part of the JWT spec. Others are user-defined.
2
The magic behind JWTs is that they standardize certain claims that are useful in the context of some common operations. For example, one of these common operations is establishing the identity of a certain party. So one of the standard claims found in JWTs is the sub (from “subject”) claim.

Scenario Questions

0-2 years experience

1Imagine you're building a profile page. You have a JWT stored in the browser. How would you extract the user's display name and email from this token to show it on the UI, and why shouldn't you trust those values for performing sensitive database writes?
2We have an API endpoint that should only be accessible for 15 minutes after login. Which standard JWT claims would you look for in the incoming token to enforce this, and what exact checks would your middleware perform?

Follow-up Questions

What is the difference between a signed JWT (JWS) and an encrypted JWT (JWE) regarding claim visibility?
How do you prevent 'token bloat' when a user has a large number of permissions or roles?
If a JWT is stateless, how do you handle a claim change (like a role change) before the token expires?