API › Module 4 › Lesson 1
JWT Structure: Header Payload Signature
Three Base64url parts — decode lab JWTs on 127.0.0.1:8813 only.
Visual · jwt_structure
header.payload.signature. 127.0.0.1:8813.
Opening
A JWT is not encrypted by default. It is encoded and signed — readable to anyone who holds it.
JSON Web Tokens usually look like three dot-separated Base64url segments: header, payload, signature. The payload claims are visible unless you also encrypt (JWE — different tool). Defenders must stop treating JWTs like opaque vaults. Original Cyberlium Module 4. Decode lab tokens from 127.0.0.1:8813. You will NOT steal JWTs from stranger apps, not forge tokens against production, not phish for id_tokens. Next: alg=none and Signature Verify.
1. Readable claims are a feature and a risk
Anyone with the token can read claims like sub, role, exp unless encrypted. Do not put passwords or raw PANs in JWT payloads.
On YOUR lab, base64url-decode the payload (pad carefully) and list claims. That is literacy, not an attack on someone else’s session.
Command guide
Try these commands — Readable claims are a feature and a risk
═══ LINUX / macOS (Web & API Security Testing) ═══
Test HTTP methods on authorized lab endpoint
Command — copy this
for method in GET POST PUT DELETE OPTIONS; do
curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
doneTest JSON API with Authorization Bearer header
Command — copy this
curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <TEST_TOKEN>" \
-d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || catCheck for CORS misconfiguration headers
Command — copy this
curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"Primary tools to practice this lesson: python3, jq. Reference sites: RFC 7519 JWT (https://www.rfc-editor.org/rfc/rfc7519); jwt.io (https://jwt.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signature is the integrity gate
Without a verified signature, the payload is fan fiction. Libraries must verify with the right key and algorithm — Module 4 lesson 2.
Write: encode ≠ encrypt; signature ≠ secrecy. Keep that sentence for the quiz.
3. Ethics
Paste only lab JWTs into decoders. Do not drop customer tokens into public jwt.io sessions without redaction policy — prefer local decode for class.
Ship a diagram note: three parts, names, and “payload is readable.”
4. What you ship: a three-part JWT map and a decoded lab payload
Named header/payload/signature. Decoded lab claims. encode≠encrypt sentence. Dest 127.0.0.1:8813. No stranger token dumping.
5. What you record before the next lesson
Date. Claim list from lab JWT. File t13-m04-l01-jwt-structure.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Paste production user JWTs into a public decoder. Assume JWT means ciphertext. Forge tokens for a SaaS.
Right
Lab decode only. Next: alg=none and Signature Verify.
Mission: see inside a lab JWT safely
1) / STOP if router. 2) Obtain a lab JWT from 127.0.0.1:8813. 3) Decode payload locally; write encode≠encrypt. Never forge against unowned APIs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for local base64url decode tips — not for cracking HS256 with wordlists against live apps.
Knowledge Check
APPLY: True or False: A normal signed JWT encrypts its claims by default.
True or False
Knowledge Check
APPLY: Three JWT parts are:
Multiple choice
Knowledge Check
APPLY: Module 4 teaching port?
Multiple choice